Last night I got a notification from one of the WordPress sites I volunteer to help manage: the notification said my admin password on that site had been changed.
I didn’t change it.
So my first instinct was, who did this? I dug into the site immediately. Logs, access records, anything that looked off. I run a suite of tools to monitor these sites for exactly this kind of thing: new files, changes to core WordPress files, anything out of place.
And sure enough, there it was. A malicious script had backdoored its way in through a plugin. Once it was in, it moved fast. It changed all 3 administrator passwords. It dropped 3 malicious files into the site. It disabled the antivirus software running against the site. Then it pulled out its own entry point, probably planning to go dormant for a while. My best guess is it handed the hacker the new admin credentials and left those 3 files behind as a way back in later.
So what’s crazy is, this wasn’t a site with problems. This site was locked down. Firewall, WAF, fully patched core, fully patched plugins. I’d changed the passwords myself a couple weeks earlier and made sure they were strong. No exposed credentials, no glaring holes. This is actually why I was watching it extra closely, since it had been compromised once before, a few weeks back, and I wasn’t taking chances a second time.
So how does a fully patched site get hacked?
I dug further and found the plugin that got exploited had been patched 6 days earlier. That means whoever wrote this exploit found a way around a fix that was, at most, less than a week old. Possibly a day or two old. That’s basically a zero day, or as close to one as it gets for a site that’s actually staying current.
I’m not naming the plugin. I know some people would want me to, so others can go patch or disable it themselves, but I’d rather give the developer the chance to do the right thing first. I’ve reached out to them directly. They’re a large, capable team. They can handle it.
So what’s crazy is, I keep hearing people say AI is only going to get smarter from here. And it’s true, and it cuts both ways. The same tools that make us 5x, 10x more productive as developers and defenders are available to whoever’s on the other side too. Vulnerabilities that used to take weeks or months to weaponize after a patch drops are getting turned around in days now. I genuinely think that’s what happened here.
So the part I really want people to hear is this. We did everything right on this site. Strong passwords. No exposed credentials. Active scanning. A patched, maintained site, run by someone who does this for a living, in his spare time, for a community he cares about. And it still got compromised.
I’ve heard people say “no one would attack my site, I’m not a big target.” Most of the time, that’s not even how it works. Attackers aren’t sitting there picking your site out by name. They’re scanning the internet in bulk, fingerprinting what’s running on every host name they find. WordPress, Squarespace, Drupal, Joomla, a React app, whatever it is. Then they go looking for known vulnerabilities and exploits that match what they found. It’s a fishing net, not a spear. You get caught in the net because of what you’re running, not because someone’s targeting you personally. A volunteer-run site is just as much a target as anything else out there. Size and stakes don’t matter to a bot running bulk scans.
And that’s not your fault, as long as you’re doing your part. Keeping the site updated. Monitoring it. Backing it up. Watching for the thing that doesn’t look right. What you can’t do anymore is put a site online and walk away from it. This isn’t the Wayback Archive. These are live, active sites, doing real work, sitting within reach of tools that make attacks faster and easier to run every year.
I want to be clear, I’m not saying any of this to scare anyone off WordPress. I still love it. I still run sites on it, professionally and as a volunteer. A lot of my own development skills got built running WordPress and CMS platforms like it. It’s a genuinely great way to host a business site, a personal blog, a community site, or even a headless backend for something bigger. None of this is a knock on the platform.
It’s just the world we’re building in now. The tools that make us faster and better also make the people trying to break in faster and better. Stay diligent. 🛠️
Leave a Reply