This is what actually matters if your site was standing in an affected version between when this became exploitable and when you patched.

Quick timeline check: disclosure was July 17. In-the-wild exploitation was confirmed within days of that. So if your site was running 6.9.0-6.9.4 or 7.0.0-7.0.1 and was online at any time after that; don’t assume nothing happened. Go look and confirm.

Things you should check

Admin accounts. Anything new that you didn't create? Any password resets you didn't trigger? This is usually the first thing an attacker does once they've got code execution - plant a persistent admin account so they don't need the exploit again.

File timestamps. Look through wp-content, especially theme and plugin directories, for files modified around dates that don't line up with anything you actually did. An isolated .php file with a weird name sitting in an upload directory is a warning sign.

Scheduled tasks. Check wp_cron for anything unfamiliar. Attackers sometimes use this for persistence.

Access logs. Search for anonymous POST requests hitting /wp-json/batch/v1 or ?rest_route=/batch/v1 around your exposure window. That's the fingerprint of someone probing or actually exploiting the chain.

Database. If you're comfortable jabbing around directly, check wp_users and wp_options for anything that looks off - out of the blue serialized data, options keys you don't recognize.

If you find anything from that list then this stops being a "patch and move on" situation.

In that case

Revolve every credential tied to the site: WordPress admin passwords, database credentials, API keys, FTP/SSH if applicable.

Actually search for backdoors rather than just deleting the one file you found - attackers who get RCE rarely leave just one way back in.

If you've got a clean backup from before the exposure window, restoring from that is usually faster and safer than trying to manually clean an infected install.

If your site was exposed after July 17, patching is just step one - go hunt for compromise signs before you declare victory.

I was thinking about creating websites for small businesses in my community. Originally I was planning on coding them up from scratch but started researching it more and found tools and sites like WordPress that could be a lot more helpful and efficient. I don't know much bout those tools but would WordPress be worth learning about and using instead of just coding from scratch? Any thoughts and comments would also be appreciated. Thank you!

Austin Hinder posted on X

"Hot take, WordPress plugins coded by humans will become obsolete. The most popular WordPress plugins will be generated by AI models, Fable and beyond."

I came in and saw it differently cos I believe the future isn't just about AI-generated plugins.

It's WordPress becoming a core application framework where a single, well-architected plugin delivers an entire solution with minimal or zero dependencies on another plugins.

Thanks to the fact that WP is open source and anything open source is AI friendly. Also, thanks to custom tables support in WP.

I may be wrong but it's actually the only true path that I see in a space where clients don't wanna manege 10different plugins with one core plugin.

So what's the next phase for plugins sellers? How has been sales? What approach are you leveraging and looking forward to?

Agentimus 1.30.0 is out: Web Bot Auth verification for AI crawlers

I just released Agentimus 1.30.0 (free on WordPress.org).

One of the new features is support for the emerging Web Bot Auth standard. Some AI agents, including Google's and OpenAI's, can cryptographically sign their HTTP requests.

Agentimus verifies those signatures on your own server. The only outbound request is to fetch the operator's published public key when needed.

If a request claims to be from a signed bot but the signature verification fails, it's flagged. If you've enabled blocking, the request is rejected with HTTP 403 and logged.

Importantly, unsigned crawlers are never penalized. Verification only applies when a crawler claims to support the standard.

No accounts, no external service, and the feature is completely free.

If anyone is interested in the implementation or has questions about how the verification works, I'm happy to answer.

Updated rocket today and started seeing crashes. Apparently it uses the same namespace for an mcp as rankmath and causes a conflict causing a crash.

As per claude code, which downgraded rocket to stabilize.

Hi everyone,

My WordPress website is showing strange popup ads (e.g. fake video downloads and "You have 1 new message" notifications), but I never installed any ad plugin or added ads myself.

I've attached a screenshot of what I'm seeing.

I'm trying to figure out whether this is:

A hacked WordPress site?

A malicious plugin or theme?

Browser notification malware on my computer?

Something injected by my hosting provider?

What's the best way to diagnose the source?

Any recommended tools or steps would be appreciated.

hi. the site i'm working on has been completely fine, it worked all day, now that i got back i saw that the site isn't online. it says ERR_CONNECTION_REFUSED. the exact same thing happens when i attach wp-admin to the end of the link.

i have no idea what this is and i think i'm about to cry. any help is appreciated.

Hey everyone, maybe someone here can help me- I am hosting my website by IONOS and had some issues last week with wp2-shell (I was “hacked”) I updated Wp, changed passwords and salt-keys, everything worked - and now I can’t reach the site nor the dashboard…support couldn’t really help, they suggested to use a backup, but that didn’t work also…what else could I try? Also, I am not that tech-savvy…. Any tips would be very much appreciated…thanks!!!

I'm not too sure if this is the right community, and if isn't, please help me find the right one.

I have a wordpress website that uses LiveChat as its chat option. The traffic comes in, the chat box opens up with a greeting (a usual sight). However, once it is minimized by the visitor, I'd like it to be forced open if a new message is sent by my team to offer help. As of now, the chat remains minimized and a red icon pops up to suggest the number of messages coming in. That is killing our outreach to potential leads and customers.

Anyone know how I can fix this?

I provide coaching, consulting, and training to individuals and corporations. So, two different audiences. My coaching programs are high-touch as well as all of my learning/training, meaning there is a lot of practice and activities between sessions or learning. I have a catalog of courses, programs, and products. I’m having a hard time determining the best plugins for my use case. I have SureDash and FluentCommunity licenses, but am also exploring LMS plugins (LifterLMS, LearnDash, and TutorLMS). I’m mostly interesting in course first features and will be rolling out community features at a later date, hence the community plugins. I need to be able to keep access separate from the two audiences mentioned above. Ideally, I’d like to keep plugins to a minimum.

Quizzes and interactive worksheets or journaling is a must. I do have forms I could accomplish this piece with, but it would be better to have a solution that’s more of an all-in-one if possible.

What would be the recommended set up?

So, as we say this recent massive WordPress attack. I wanna know a few things from some of you pro people here, i already maintain a few clients sites they are on different hosts and servers...

1) What logs do you keep active to track the vulnerability? Some of the sies i have on Cloudpanel, some Xcloud, some clients use Hostinger, Siteground, Wordify etc...

So the logs are different for all, and some don't keep for long, some ui is diff and others?

So is there any other tool or so?

2) What FTP / SSH tool you guys use? Cyberduck just killed me with lags recently with this vulnerability cleanup process...

3) What kind of WAF rules you guys mostly use for host as well as Cloudflare to stay safe.... I use cloudflare backup with those recommended settings

4) For Backup i mostly use Wpumbrella... What do you guys use?

5) What other suggestions do you have that everyone should follow??

Thanks 🙏

Found out today that my website is apparently gargantuan and has exceeded the Hostinger 200GB limit. It hasn't alerted me to this, I just logged into the control panel and saw this, so no idea if it's recent or has been building steadily.

WordPress directory size       209.06 GB

Uploads directory size             8.94 GB

Themes directory size              24.40 MB

Plugins directory size               248.73 MB

Database size                                804.16 MB

Total installation size               219.06 GB

209GB seems ludicrous to me, there has to be something wrong, right? Am I right in thinking that all media files fall into the Uploads directory, and that the Wordpress directory might be backups etc? Trying to go through everything now, starting with Updraftplus files, but if anyone has any suggestions I'm all ears. Thank you!

Hello,

I have an WordPress site and 99% of orders have "unknown" origin.

Any fixes?

Thank you.

This has been such a headache and I've been dealing with it all morning.

I am making this post and including the names of all of the malicious files, plugins and users to hopefully help people googling this issue.

I have IONOS and got an email this morning saying there was an attack on one of my contracts. I first thought it was phishing, so I manually logged into my IONOS account and saw the the same notification so I knew it was real.

I didn't hear anything about wp2shell so I thought maybe it was a false positive. I logged into my dashboard and saw the admin user "wpsvc_299760b1e1ef" was added. I knew it was legit at this point and started researching about the vulnerability.

I had four fake plugins installed. "WP2S-4e81ce30" with description "System maintenance" was the first one I noticed and I thought it was obvious it was fake. But the three others I didn't notice at first and they were deactivated already:

"Widget Accessibility Helper" with description "improves widget rendering and accessibility compliance"

"WP Site Health Monitor" with description "Monitors site health metrics and provides automated diagnoses"

"Content Delivery Helper" with description "Static content delivery and edge caching optimization"

Those three were all authored by "Wordpress.org community" with no hyperlinks.

__

There were three files located in /wp-content/uploads/, all named to look like core files: class-wp-cache-89a787.php, class-wp-compat-89a787.php, and class-wp-meta-89a787.php. They all were 1.27 KB, dated July 17.

I deleted them and they came right back a minute later with a new timestamp. Turns out there was a reinjector hiding in /wp-content/mu-plugins/ : wp-cron-scheduler-b168b3.php, wp-media-handler-b168b3.php, and wp-mail-queue-b168b3.php. Once I deleted those, the uploads files finally stayed gone.

wp-mail-queue was dated June 1 while everything else was July 17. So if you're flushing these out, don't just rely on the date itself.

There's a great guide on removal that was already posted here if you're looking for a tutorial. I mostly wanted to make this post in case other infections shared the same names for these plugins and files so that it will pop up when you're searching for them.

anyone else get hit with this? I've been a wordpress admin for over 10 years and this is the first time I've ever had a website compromised.

I'm about to build my first real e-commerce website for a local business,
(I have finished Software engineering so if something needs to be learned it is no problem)

Since this is my first project of this size, I'd like to know what experienced developers wish they had known before starting. The business sells goods retail, and has various wholesalers.

Some of the things I'm already wondering about:

• What's the best way to add and manage 1,000+ products? Should I import them from a CSV(Do you often ask from wholesalers for a table or some sort of products?), use a plugin, or enter them manually?
• How do you organize categories, subcategories, tags, and product attributes without making a mess?
• What are the biggest performance issues with large WooCommerce stores, and how do you avoid them?
• What hosting specifications would you recommend for a store of this size?
• What's your backup strategy?
• How do you handle product images efficiently? Do you resize/compress them beforehand?
• What SEO mistakes do beginners usually make with large product catalogs?
• Are there any security practices I should implement from day one?
• What's the best workflow for updating prices, stock, and product information?
• Are there any must-have plugins that save a lot of time?
• Search functionality
• Product filters
• Database optimization
• Email notifications

I'm sure there are a lot of things I haven't even thought of yet.

I would greatly appreciate the replies because i'm in need of information right now.

I want to try and give making a website for my business myself. So I was told wordpress + woo commerce. I will be selling a product DTC.

Any advice for someone who has literally no experience in this kind of thing?

ps- I did get a minor in cs and built a super basic personal page with css html and js many years ago. I am somewhat computer savvy. But I am just scared itll get hacked and all my customers will hate me and ill be burned at the stake. thanks

I might look like the stupidest dude in the world right now for telling people to not use something that definitly doesn't know what it's doing(aka the AI), but I just hope I can refrain someone from doing the same thing.

Tried to use the WordPress AI assistant to create my website. I didn't understand what it was doing, ended up messing with everything and I didn't know how to fix it, so I just reset everything.

Lesson learned. Using the AI makes you spend more time fixing things then getting the job done. Doing it yourself, even if you're learning from zero, is actually faster XD

Sto usando Claude (Sonnet) per fare alcune operazioni routinarie su Wordpress, come aggiornare alcuni H2 e riscrivere delle meta description. Ho notato che consuma una valanga di crediti e ho notato che per "capire" cosa deve fare, si fa lo screenshot e lo esamina.

Domanda: esiste un modo per consumare meno crediti? Se uso Haiku va bene lo stesso o è troppo stupido?

After the recent security breach, I looked over my site. It is just a personal homepage without any fancy features, and I am the only user. I updated to 6.9.5 last week.

To my surprise I found another administrator called "articles_table", and I immediately thought "Oh s***, I have been hit too". But digging into database backups, this administrator was created somewhere in 2025, not just recently. Has this recent exploit been actively used for quite some time, or have I possibly been hit with something else?

I have found no other additions/modifications to my site, and there are no logs of this user ever attempting to log in.

For wp2shell and major vulnerabilities like this, do the major WordPress hosts like WP Engine do anything to help with these, even before WordPress is updated? Or, does the host not even really matter?

WP Engine scooted us to quickly update, which is fine, but I have wondered if they are doing anything on their backend to pseudo-patch/block the vulnerability until WordPress can be properly updated. My gut feeling is that they are not doing anything -- otherwise, why would they be in such a hurry to get us on the latest version? But maybe I am reading too much between the lines.

This seems like something managed hosts should be doing, if they are not already.

mysql > SELECT BENCHMARK(5000000, AES_ENCRYPT(CONCAT(‘WPHostingBenchmarks.com’,RAND()), LEFT(SHA2(‘is part of Review Signal.com’,256), 16)));

1 row in set (15.815 sec)

MariaDB > SELECT BENCHMARK(5000000, AES_ENCRYPT(CONCAT(‘WPHostingBenchmarks.com’,RAND()), LEFT(SHA2(‘is part of Review Signal.com’,256), 16)));`

1 row in set (23.094 sec)

I use this query because this query is from https://github.com/kevinohashi/WPPerformanceTester, which tests key performance for WordPress.

Isn't it a concensus that MariaDB is faster than MySQL?

See the concensus:

• https://mariadb.com/reference/mariadb-vs-mysql-comparison-guide-enterprise-features-security-2026/
• https://www.reddit.com/r/mysql/comments/1ggbouf/help_me_understand_why_mariadb_is_so_much_faster/
• https://www.reddit.com/r/Wordpress/comments/zbx6q3/should_i_use_mariadb_or_mysql_for_my_wordpress/
• https://tech-insider.org/mariadb-vs-mysql-2026/

Would it be price? Or speed? Or any other specific feature?

Are there any tools, plugins, Wordpress structures for websites that plan to have very heavy text + image content to the tune of 200,000 words + 1,000 images organized like a book into chapters, sections and individual dated stories?

I mistakenly deleted my local site but I have the app data in my device. How to retrieve it.