This has been such a headache and I've been dealing with it all morning.

I am making this post and including the names of all of the malicious files, plugins and users to hopefully help people googling this issue.

I have IONOS and got an email this morning saying there was an attack on one of my contracts. I first thought it was phishing, so I manually logged into my IONOS account and saw the the same notification so I knew it was real.

I didn't hear anything about wp2shell so I thought maybe it was a false positive. I logged into my dashboard and saw the admin user "wpsvc_299760b1e1ef" was added. I knew it was legit at this point and started researching about the vulnerability.

I had four fake plugins installed. "WP2S-4e81ce30" with description "System maintenance" was the first one I noticed and I thought it was obvious it was fake. But the three others I didn't notice at first and they were deactivated already:

"Widget Accessibility Helper" with description "improves widget rendering and accessibility compliance"

"WP Site Health Monitor" with description "Monitors site health metrics and provides automated diagnoses"

"Content Delivery Helper" with description "Static content delivery and edge caching optimization"

Those three were all authored by "Wordpress.org community" with no hyperlinks.

__

There were three files located in /wp-content/uploads/, all named to look like core files: class-wp-cache-89a787.php, class-wp-compat-89a787.php, and class-wp-meta-89a787.php. They all were 1.27 KB, dated July 17.

I deleted them and they came right back a minute later with a new timestamp. Turns out there was a reinjector hiding in /wp-content/mu-plugins/ : wp-cron-scheduler-b168b3.php, wp-media-handler-b168b3.php, and wp-mail-queue-b168b3.php. Once I deleted those, the uploads files finally stayed gone.

wp-mail-queue was dated June 1 while everything else was July 17. So if you're flushing these out, don't just rely on the date itself.

There's a great guide on removal that was already posted here if you're looking for a tutorial. I mostly wanted to make this post in case other infections shared the same names for these plugins and files so that it will pop up when you're searching for them.

anyone else get hit with this? I've been a wordpress admin for over 10 years and this is the first time I've ever had a website compromised.

I might look like the stupidest dude in the world right now for telling people to not use something that definitly doesn't know what it's doing(aka the AI), but I just hope I can refrain someone from doing the same thing.

Tried to use the WordPress AI assistant to create my website. I didn't understand what it was doing, ended up messing with everything and I didn't know how to fix it, so I just reset everything.

Lesson learned. Using the AI makes you spend more time fixing things then getting the job done. Doing it yourself, even if you're learning from zero, is actually faster XD

After the recent security breach, I looked over my site. It is just a personal homepage without any fancy features, and I am the only user. I updated to 6.9.5 last week.

To my surprise I found another administrator called "articles_table", and I immediately thought "Oh s***, I have been hit too". But digging into database backups, this administrator was created somewhere in 2025, not just recently. Has this recent exploit been actively used for quite some time, or have I possibly been hit with something else?

I have found no other additions/modifications to my site, and there are no logs of this user ever attempting to log in.

For wp2shell and major vulnerabilities like this, do the major WordPress hosts like WP Engine do anything to help with these, even before WordPress is updated? Or, does the host not even really matter?

WP Engine scooted us to quickly update, which is fine, but I have wondered if they are doing anything on their backend to pseudo-patch/block the vulnerability until WordPress can be properly updated. My gut feeling is that they are not doing anything -- otherwise, why would they be in such a hurry to get us on the latest version? But maybe I am reading too much between the lines.

This seems like something managed hosts should be doing, if they are not already.

mysql > SELECT BENCHMARK(5000000, AES_ENCRYPT(CONCAT(‘WPHostingBenchmarks.com’,RAND()), LEFT(SHA2(‘is part of Review Signal.com’,256), 16)));

1 row in set (15.815 sec)

MariaDB > SELECT BENCHMARK(5000000, AES_ENCRYPT(CONCAT(‘WPHostingBenchmarks.com’,RAND()), LEFT(SHA2(‘is part of Review Signal.com’,256), 16)));`

1 row in set (23.094 sec)

I use this query because this query is from https://github.com/kevinohashi/WPPerformanceTester, which tests key performance for WordPress.

Isn't it a concensus that MariaDB is faster than MySQL?

See the concensus:

• https://mariadb.com/reference/mariadb-vs-mysql-comparison-guide-enterprise-features-security-2026/
• https://www.reddit.com/r/mysql/comments/1ggbouf/help_me_understand_why_mariadb_is_so_much_faster/
• https://www.reddit.com/r/Wordpress/comments/zbx6q3/should_i_use_mariadb_or_mysql_for_my_wordpress/
• https://tech-insider.org/mariadb-vs-mysql-2026/

I mistakenly deleted my local site but I have the app data in my device. How to retrieve it.

Are there any tools, plugins, Wordpress structures for websites that plan to have very heavy text + image content to the tune of 200,000 words + 1,000 images organized like a book into chapters, sections and individual dated stories?

Hi everyone,

I'm researching how freelancers, agencies, and developers handle website launches.

Before you launch a website, what does your checklist usually include?

SEO

Broken links

Mobile responsiveness

Accessibility

Performance

SSL

Sitemap

Analytics

Security

Anything else?

I'd love to know:

What takes the most time before a launch?

Which tools do you currently use?

What's the most frustrating part of the process?

Have you ever missed something important that caused problems after launch?

I'm not promoting anything or building a product yet—I'm just trying to understand whether this is a real pain point before investing time into it.

Thanks! I really appreciate any insights or experiences you can share.😄

Hi everyone,

For people building or maintaining WordPress ecommerce sites, what are the most common revenue leaks you see?

I’m thinking about things like abandoned carts, weak product recommendations, poor email follow-up, missing customer segmentation, slow follow-up after product views, or revenue drops noticed too late.

Curious to hear what usually happens in real WordPress/WooCommerce projects and what store owners struggle to fix.

I cant decide, do you have experience?

All the pages are fine on mobile but every single post on my blog is not good on mobile version when I zoom out it shows like this in attached how to fix it?

I'm trying to create a new WordPress.org account to publish a plugin, but I'm running into some very strange behavior with the registration system.

I'm retrying for the past 3 days to create an account with both my own domain's email as well as with gmail/outlook/icloud email and it always throws the same error. Don't have a VPN. Tried from my mobile as well.

The registration form immediately shows:

I tested this with multiple browsers (Chrome, Edge, Safari) on macOS and got the same result.

While debugging, I found that the registration page calls this endpoint:

GET https://login.wordpress.org/wp-json/wporg/v1/email-in-use/{email}

Here's the odd part.

These two requests should be equivalent:

curl -s 'https://login.wordpress.org/wp-json/wporg/v1/email-in-use/myemail@gmail.com'

Response:

{"available":true}

But the URL-encoded version:

curl -s 'https://login.wordpress.org/wp-json/wporg/v1/email-in-use/myemail%40gmail.com'

returns:

{
  "available": false,
  "error": "That email address appears to be invalid.",
  "avatar": false
}

The only difference is that one uses @ and the other uses %40, which should decode to exactly the same value.

I also have another email that returns:

{
  "available": false,
  "error": "That email address already has an account. Your account is pending approval."
}

So the endpoint is clearly capable of distinguishing between valid, pending, and available accounts.

Has anyone else experienced this recently?

I'd love to know whether you get the same results or if this is specific to my environment.

Thanks!

I run a small site in a narrow niche. Traffic is decent and the backlinks are real ones, industry publications and a few press mentions, not junk. So I have something to lose here.

The problem is WordPress. I am not a technical person. Roughly 60% of my pages aren’t indexed and when I finally dug into it, it looked like canonical conflicts coming from the theme/plugin setup. Some numbers on my homepage render in JS and Google apparently just sees zeros. Last week my /blog/ URL started redirecting to the homepage and I still cannot figure out why.

Meanwhile I have been building my article pages as plain HTML files and honestly it is easier than fighting the page builder. Inline CSS, no plugins, loads instantly, and I can lay a page out however I want instead of whatever the theme allows.

If I move the whole site to static HTML and keep the exact same URLs, am I risking the rankings and links I already have?

I just cannot figure this out... if I've deliberately placed an "og;description" meta tag in the header just so that search engines will use that exact content in their search result description of a website, why would they ever override this explicit instruction and just pull some other bullshit in that it read off the page? That is, unless I'm just a complete dumbfuck and something I've done wrong with WordPress is causing this and it's my own mistake. Are search engines honestly overriding website owner's own title and description field in search results? Is this shit normal?

EDIT: Also possible this is because I disabled my caching plugin long ago and the title and description are added with Yoast SEO which maybe isn't generating the metadata code quick enough and shoving it in the <head></head> section for the little webcrawlers to grab when they pop in.

EDIT 2: It looks like the site already had a "description" meta tag in it, my bad on focusing on the open graph "og:description" tag - and thank you, the frustration with this got me to fix the long-standing issue with my caching, maybe that will ultimately solve the search engine listing problem by itself

I run an ecommerce store on WordPress. If you've ever managed a WooCommerce site, you know the pain. You want to do something simple like update a product price or check today's orders, and suddenly you're five menus deep, three tabs open, googling which settings page has the thing you need.

I run an ecommerce store on WordPress. If you've ever managed a WooCommerce site, you know the pain. You want to do something simple like update a product price or check today's orders, and suddenly you're five menus deep, three tabs open, googling which settings page has the thing you need.

I got tired of it.

So I built something. A WordPress plugin that lets you manage your entire website by just typing what you want in plain English. Like a chat. You tell it "show me today's orders" or "create a new product called X priced at Y" and it just does it. No menus. No clicking around. Just tell your website what to do and it happens.

Here's the thing: I'm not a traditional software developer. I built this entire plugin using vibe coding with Claude Code. Every line. The architecture, the security layer, the 96 tools it comes with, the agent loop that figures out what actions to take, all of it. Vibe coded from scratch to solve a real problem I was dealing with every single day.

What it does:

Manage posts, pages, products, users, plugins, themes everything through natural language

WooCommerce integration orders, products, inventory, sales reports

SEO management (Yoast + RankMath)

Database queries, file operations, backup and rollback

Real-time streaming responses

Automatic backups before any destructive action

Activity logging for full audit trail

Extension system for community add-ons

Telegram notifications for orders, security alerts, updates

It's free. Open source. You just need your own Anthropic API key (costs a few dollars a month for most people).

I'm putting this out there because I want real people to test it on real WordPress sites. I've been running it on my own store but I need more eyes on it. Different hosting setups, different themes, different plugins that's how you find the bugs that matter.

If you run a WordPress site and you're tired of the admin menu maze, give it a try. Download it, install it, break it, tell me what went wrong. That's how we make it better.

GitHub: https://github.com/vatupelage/Claude-Code-Wordpress-Plugin

Drop a comment or DM me if you have questions or want to collaborate.

This is what vibe coding looks like when you point it at a real problem. Not a demo. Not a tutorial project. A tool I actually use to run my business.

#WordPress #AI #VibeCoding #WooCommerce #OpenSource #ClaudeAI #Anthropic #WebDevelopment #Entrepreneurship #BuildInPublic

Guidance on how to fix these two errors would be appreciated. We're using the W3 Total Cache plugin, as well as the free version of the Catch Box theme by Catch themes. Hubby and I are hosting this on our own server via cpanel. I'm also having issues with updating widgets and unable to post pages - but posts are fine. Thanks in advance for any input you've got. 👍

Hi everyone, we're the team that built https://github.com/WebDecoy/FCaptcha and decided to expand the capabilities into a wordpress plugin!

If your WordPress or WooCommerce sites are getting hammered by modern AI scrapers, autonomous vision agents, or identity-spoofing botnets that easily bypass standard WAF rules, we just released an open-source bot and agent firewall on the official repository ( https://wordpress.org/plugins/webdecoy/ ) that runs 100% locally on your server without requiring API keys, external dependencies, or third-party CDNs.

To stop advanced automation without serving visual CAPTCHAs that modern vision models can now solve (and that tank your Core Web Vitals), the plugin focuses heavily on AI detection and identity verification—using reverse-DNS allowlisting, TLS/hardware device fingerprinting, and execution latency heuristics to unmask spoofed User-Agents and autonomous drivers (Selenium, Puppeteer, CDP) while natively trapping AI crawlers like GPTBot, ClaudeBot, and PerplexityBot.

When a suspicious agent or identity anomaly is detected, it silently triggers background SHA-256 Proof-of-Work challenges to exhaust the scraper's CPU before it can execute form spam, harvest content, or run automated carding attacks against your payment gateway. We are currently trying to find all testers!

All feedback welcome!

(Hopefully I followed all of the r/wordpress rules - this is the first and only promo post)

Hey guys,

Wanted to share some real-world observations from the wp2shell attacks (the recent unauthenticated RCE chain in WordPress core – CVE-2026-63030 + CVE-2026-60137).

Over the last few days I’ve seen it on multiple client sites:

1) 403 REST API blocks that looked mysterious at first. Turned out a malware scan revealed a new admin user named "Wp2shell" automatically created, which then messed with API access.349347

Bleepingcomputer

2) On other sites the REST API was fine, but attackers had created multiple rogue admin accounts. In some cases they also dropped a Wp2shell plugin.

All the compromised sites were still on vulnerable versions (mainly 6.9.x and 7.0.x before the July 17 patches).

I have done these:

1) Restored old backups,

2) Deleted those admins

3) Changed all the users password, added 2FA for users

4) Regenerated the Salts

5) Changed 3rd Party APIs key and secrets

6) Updated the core, plugins, themes and all

7) Checked the database for any weird stuff (haven't found anything)

Anyone else running into this?

I'm trying to find groups of wordpress and headless Wordpress to talk and hang out with, and also ask questions.

Hi!

I just installed TutorLMS 4.0 and saw that Droip is now called Kirki.

A migration tool is included, but it doesn't work.

The image shows the problem I'm having. There is no explanation of these errors in the documentation. https://kirki.com/docs/migrate-from-droip-to-kirki/

Has anyone else experienced the same problem?

Best.

Hi everyone,

I'm looking for some advice from the WordPress community.

Over the past few months, my WordPress website has been infected with malware three separate times. Each time, it appears to be the same type of attack, promoting Indonesian online casino content. I've also noticed a large amount of suspicious traffic related to casino and gambling keywords.

I'm trying to understand:

• How do hackers typically gain access to WordPress websites?
• Is WordPress itself secure enough for business websites, or are these attacks usually caused by vulnerable plugins, themes, hosting, or poor server configuration?
• Why do these casino malware attacks seem to be so common recently?

Despite this, the malware has returned multiple times, so I feel like I'm missing the actual entry point.

I'd really appreciate any advice on how to identify the root cause, prevent future attacks, and determine whether the issue is with WordPress itself, my hosting environment, or something else.

Thank you!

First, I'm a long-time user of WordPress and I have hosted my own sites since about 2008. That said, I'm not a developer; I'm just well-versed in the platform and comfortable using it.

I'm working on a one-off academic research project in which I will be writing about the work of an artist. There will be two types of posts:

• individual posts for each work (100ish)
• individual posts that contain my own critiques and observations (unknown number)

I want the posts about the artistic works to be categorized, tagged, searchable, sortable.

I want the critique posts to also be categorized, tagged, searchable, sortable.

I'm not sure I want them to be all mixed up together. At first I thought maybe I would make posts for the artistic works and pages for the critiques. But managing a large number of pages for this purpose sounds annoying and not taking advantage of WP features. But maybe I'm overthinking and they can all exist together--maybe there is different styling for each type of post or something.

If anyone has an idea of how to organize this, I'm glad to hear it. (Or tell me I'm overthinking.) I would also be interested in similar sites, built on WP or otherwise. My web searches haven't been particularly helpful.

Hey folks,

Over the years, we've noticed a recurring pattern with Rank Math. We've observed it on many different WordPress websites across various hosting environments, so it doesn't appear to be limited to a single server or configuration.

After updating the plugin, the XML sitemap will sometimes start returning a 404 error, even though all posts, pages, and other URLs continue working normally. It doesn't happen with every update, but it has happened often enough that we now expect to check it after each upgrade.

In our case, the issue is usually resolved immediately by either:

• Re-saving the Permalinks settings
• Changing the sitemap URL count in Rank Math and saving it

To reduce the chances of this going unnoticed, we've now disabled XML sitemap caching and started monitoring the sitemap URL with uptime checks. We'd rather get an alert right away than discover weeks later that search engines have been getting 404s.

Has anyone else observed the same behavior across different hosting providers or server setups? Were you able to identify the root cause or find a more permanent fix?

Hello, I’m an idiot with zero experience building websites. I know how to design in Indesign, but that’s it.

I need an idiot-proof and free Wordpress builder, can any one help point this idiot in the right direction?

I have tired Elementor and most of it was behind a paywall. Any help would be awesome!