I have cleaned nineteen compromised WordPress installs for forum members and clients in the last ten months. The attack surface is boringly consistent.
1. An abandoned plugin doing something important
Fourteen of nineteen. Not an obscure plugin — usually a form builder, a slider, or a backup plugin that stopped being updated two years ago and nobody noticed because it still worked. If a plugin has not shipped in 18 months, it is a liability regardless of how many installs it has.
2. Admin accounts nobody owns
Eleven of nineteen had at least one admin account belonging to a developer or agency who finished the job in 2022. One site had six. Audit your user table today, it takes four minutes.
3. File write permissions wide open
Eight of nineteen were running with the whole wp-content tree writable by the web server, usually because someone fixed an upload error by chmod-ing until it worked. That turns a small plugin bug into a full shell.
What nobody was compromised through
Brute-forced passwords. Zero out of nineteen. Everybody is buying login-attempt limiters and nobody is reading their plugin list.
The fifteen-minute version
- Delete every plugin you are not actively using, not just deactivate it — inactive plugin files are still reachable
- Check the last-updated date on everything that survives
- Remove admin accounts you cannot name a human for
- Put file permissions back to 644/755 and fix the actual upload problem properly
Infrastructure nerd. Proxies, VPS, headless everything.