Plugin exploit waves: what WordPress site owners should do the week a mass exploit hits

These are mass-exploit waves. Nobody picked your site by hand. Automated tools try every WordPress site they can find, and any site still running the vulnerable version is a candidate. The worst holes let an attacker run their own code on the server (remote code execution), which means they can plant files, create users, or change settings without ever logging in.

This post covers what to do the week a wave hits, how to tell whether your site was already reached, and when it is time to book cleanup instead of just updating. It is not a full malware-removal guide. We do not promise ranking recovery dates or Safe Browsing clear times.

If you already see signs of a hack, skim our first 24 hours after a WordPress hack guide first.

What owners usually see

• A host, security plugin, or news story warning about a specific plugin you use
• An update for that plugin marked as a security fix, sometimes several in a row
• Nothing visible yet, which is the most common and the most misleading state
• Or, a few days later: spam titles in Google, phone visitors redirected, an administrator you do not recognize, or files with odd names and recent dates
• The host warns about malware, high resource use, or outbound spam from the account

Related live guides if you recognize a sibling pattern:

• Spam links keep coming back after I delete them
• Phone visitors redirect, desktop looks normal
• Unknown WordPress administrator appeared overnight
• Nulled WordPress theme and a hacked site

Why updating alone is not always enough

At a pattern level (not a claim about your specific site):

• The update closes the door, it does not remove anyone who already came in. If the site was reached before you patched, planted files and users stay behind.
• Waves move fast. Scanning often starts within hours or days of a public fix, so a site that updated a week late may have been exposed the whole time.
• Attackers add a second way in. A common first step after getting in is to plant a backdoor or extra administrator so the site stays open even after the plugin is patched.
• Clean looking is not the same as clean. Many planted files do nothing visible until they are told to.

We name the type of door when the evidence supports it. We do not invent a story about a specific vulnerability to make a report sound better.

This week: patch, then check (preserve before you touch)

1. Take a full files-plus-database copy and store it off the server before changing anything. If the site was already reached, that copy is your evidence (see don't wipe the host yet).
2. Update the affected plugin to the fixed version from the official source. If no fix exists yet, deactivate the plugin until one does, if the site can run without it.
3. Check your user list for administrators or editors nobody created, and note when they appeared.
4. Look for recent file changes in plugins, themes, and uploads around the dates the wave was reported. PHP files inside uploads are a strong warning sign.
5. Change passwords from a clean device for every WordPress administrator, the hosting panel, SFTP, and the database if anything looks off. Turn on two-factor sign-in where you can.
6. Use the free WordPress compromise checklist to preserve evidence and decide what is safe to touch. It does not fully clean a compromised site by itself.

When to stop and call

If the checks above come back clean, keeping things updated may be all you need. Book WordPress incident response when any of these are true:

• You find users, files, or scheduled tasks you cannot explain
• Spam, redirects, or security warnings are already showing up
• The site was running the vulnerable version for days or weeks before you patched
• WooCommerce, payments, booking, or lead forms need to stay up while cleanup happens carefully
• You need a written report of what was found, removed, and rotated

Published cleanup packages start around $2,500 (typical ranges and combined cleanup and hardening options are on the IR page). Work is remote nationwide; Tri-Cities and Western NC onsite is by appointment.

What careful cleanup usually means (expectations)

• Preserve evidence first (off-server files and database)
• Confirm the vulnerable component is patched or removed
• Compare installed plugins and themes against legitimate copies to find added code
• Remove planted files, rogue users, scheduled tasks, and database injections
• Rotate access for WordPress, hosting, SFTP, the database, and the email behind each admin
• Deliver a written report of what was removed, what access was rotated, and what still needs an owner step (Search Console, host panel)
• We do not promise Google timelines, Safe Browsing clear dates, or ranking recovery dates

After cleanup, an ongoing Care plan ($149 / $249 / $399) keeps plugins and themes on a regular update schedule so the next wave is less likely to find an open door. Care does not replace cleanup while the site is still compromised.