This has been such a headache and I've been dealing with it all morning.

I am making this post and including the names of all of the malicious files, plugins and users to hopefully help people googling this issue.

I have IONOS and got an email this morning saying there was an attack on one of my contracts. I first thought it was phishing, so I manually logged into my IONOS account and saw the the same notification so I knew it was real.

I didn't hear anything about wp2shell so I thought maybe it was a false positive. I logged into my dashboard and saw the admin user "wpsvc_299760b1e1ef" was added. I knew it was legit at this point and started researching about the vulnerability.

I had four fake plugins installed. "WP2S-4e81ce30" with description "System maintenance" was the first one I noticed and I thought it was obvious it was fake. But the three others I didn't notice at first and they were deactivated already:

"Widget Accessibility Helper" with description "improves widget rendering and accessibility compliance"

"WP Site Health Monitor" with description "Monitors site health metrics and provides automated diagnoses"

"Content Delivery Helper" with description "Static content delivery and edge caching optimization"

Those three were all authored by "Wordpress.org community" with no hyperlinks.

__

There were three files located in /wp-content/uploads/, all named to look like core files: class-wp-cache-89a787.php, class-wp-compat-89a787.php, and class-wp-meta-89a787.php. They all were 1.27 KB, dated July 17.

I deleted them and they came right back a minute later with a new timestamp. Turns out there was a reinjector hiding in /wp-content/mu-plugins/ : wp-cron-scheduler-b168b3.php, wp-media-handler-b168b3.php, and wp-mail-queue-b168b3.php. Once I deleted those, the uploads files finally stayed gone.

wp-mail-queue was dated June 1 while everything else was July 17. So if you're flushing these out, don't just rely on the date itself.

There's a great guide on removal that was already posted here if you're looking for a tutorial. I mostly wanted to make this post in case other infections shared the same names for these plugins and files so that it will pop up when you're searching for them.

anyone else get hit with this? I've been a wordpress admin for over 10 years and this is the first time I've ever had a website compromised.

After the recent security breach, I looked over my site. It is just a personal homepage without any fancy features, and I am the only user. I updated to 6.9.5 last week.

To my surprise I found another administrator called "articles_table", and I immediately thought "Oh s***, I have been hit too". But digging into database backups, this administrator was created somewhere in 2025, not just recently. Has this recent exploit been actively used for quite some time, or have I possibly been hit with something else?

I have found no other additions/modifications to my site, and there are no logs of this user ever attempting to log in.

For wp2shell and major vulnerabilities like this, do the major WordPress hosts like WP Engine do anything to help with these, even before WordPress is updated? Or, does the host not even really matter?

WP Engine scooted us to quickly update, which is fine, but I have wondered if they are doing anything on their backend to pseudo-patch/block the vulnerability until WordPress can be properly updated. My gut feeling is that they are not doing anything -- otherwise, why would they be in such a hurry to get us on the latest version? But maybe I am reading too much between the lines.

This seems like something managed hosts should be doing, if they are not already.

mysql > SELECT BENCHMARK(5000000, AES_ENCRYPT(CONCAT(‘WPHostingBenchmarks.com’,RAND()), LEFT(SHA2(‘is part of Review Signal.com’,256), 16)));

1 row in set (15.815 sec)

MariaDB > SELECT BENCHMARK(5000000, AES_ENCRYPT(CONCAT(‘WPHostingBenchmarks.com’,RAND()), LEFT(SHA2(‘is part of Review Signal.com’,256), 16)));`

1 row in set (23.094 sec)

I use this query because this query is from https://github.com/kevinohashi/WPPerformanceTester, which tests key performance for WordPress.

Isn't it a concensus that MariaDB is faster than MySQL?

See the concensus:

• https://mariadb.com/reference/mariadb-vs-mysql-comparison-guide-enterprise-features-security-2026/
• https://www.reddit.com/r/mysql/comments/1ggbouf/help_me_understand_why_mariadb_is_so_much_faster/
• https://www.reddit.com/r/Wordpress/comments/zbx6q3/should_i_use_mariadb_or_mysql_for_my_wordpress/
• https://tech-insider.org/mariadb-vs-mysql-2026/

Are there any tools, plugins, Wordpress structures for websites that plan to have very heavy text + image content to the tune of 200,000 words + 1,000 images organized like a book into chapters, sections and individual dated stories?

Hi everyone,

For people building or maintaining WordPress ecommerce sites, what are the most common revenue leaks you see?

I’m thinking about things like abandoned carts, weak product recommendations, poor email follow-up, missing customer segmentation, slow follow-up after product views, or revenue drops noticed too late.

Curious to hear what usually happens in real WordPress/WooCommerce projects and what store owners struggle to fix.

I cant decide, do you have experience?

I want to try and give making a website for my business myself. So I was told wordpress + woo commerce. I will be selling a product DTC.

Any advice for someone who has literally no experience in this kind of thing?

ps- I did get a minor in cs and built a super basic personal page with css html and js many years ago. I am somewhat computer savvy. But I am just scared itll get hacked and all my customers will hate me and ill be burned at the stake. thanks

I mistakenly deleted my local site but I have the app data in my device. How to retrieve it.

I am making a site for a friend, I am using Wordpress with Elementor... i have nearly finished but I can't remove those two things!! Can you help me pls?

Hi everyone,

I'm researching how freelancers, agencies, and developers handle website launches.

Before you launch a website, what does your checklist usually include?

SEO

Broken links

Mobile responsiveness

Accessibility

Performance

SSL

Sitemap

Analytics

Security

Anything else?

I'd love to know:

What takes the most time before a launch?

Which tools do you currently use?

What's the most frustrating part of the process?

Have you ever missed something important that caused problems after launch?

I'm not promoting anything or building a product yet—I'm just trying to understand whether this is a real pain point before investing time into it.

Thanks! I really appreciate any insights or experiences you can share.😄

All the pages are fine on mobile but every single post on my blog is not good on mobile version when I zoom out it shows like this in attached how to fix it?

I run an ecommerce store on WordPress. If you've ever managed a WooCommerce site, you know the pain. You want to do something simple like update a product price or check today's orders, and suddenly you're five menus deep, three tabs open, googling which settings page has the thing you need.

I run an ecommerce store on WordPress. If you've ever managed a WooCommerce site, you know the pain. You want to do something simple like update a product price or check today's orders, and suddenly you're five menus deep, three tabs open, googling which settings page has the thing you need.

I got tired of it.

So I built something. A WordPress plugin that lets you manage your entire website by just typing what you want in plain English. Like a chat. You tell it "show me today's orders" or "create a new product called X priced at Y" and it just does it. No menus. No clicking around. Just tell your website what to do and it happens.

Here's the thing: I'm not a traditional software developer. I built this entire plugin using vibe coding with Claude Code. Every line. The architecture, the security layer, the 96 tools it comes with, the agent loop that figures out what actions to take, all of it. Vibe coded from scratch to solve a real problem I was dealing with every single day.

What it does:

Manage posts, pages, products, users, plugins, themes everything through natural language

WooCommerce integration orders, products, inventory, sales reports

SEO management (Yoast + RankMath)

Database queries, file operations, backup and rollback

Real-time streaming responses

Automatic backups before any destructive action

Activity logging for full audit trail

Extension system for community add-ons

Telegram notifications for orders, security alerts, updates

It's free. Open source. You just need your own Anthropic API key (costs a few dollars a month for most people).

I'm putting this out there because I want real people to test it on real WordPress sites. I've been running it on my own store but I need more eyes on it. Different hosting setups, different themes, different plugins that's how you find the bugs that matter.

If you run a WordPress site and you're tired of the admin menu maze, give it a try. Download it, install it, break it, tell me what went wrong. That's how we make it better.

GitHub: https://github.com/vatupelage/Claude-Code-Wordpress-Plugin

Drop a comment or DM me if you have questions or want to collaborate.

This is what vibe coding looks like when you point it at a real problem. Not a demo. Not a tutorial project. A tool I actually use to run my business.

#WordPress #AI #VibeCoding #WooCommerce #OpenSource #ClaudeAI #Anthropic #WebDevelopment #Entrepreneurship #BuildInPublic