Today I realized that my WordPress blog was hacked. I noticed, because the title was altered to something like:

+ADw-/title+AD4-Hacked By *** +ADw-meta http-equiv+AD0AIg-refresh+ACI content+AD0AIg-5+ADs-URL+AD0-http://***+ACIAPg +ADw-DIV style+AD0AIg-DISPLAY: none+ACIAPgA8-xmp+AD4-

After a while I couldn't login with my usual password, so I went to the host's cPanel and I tried to reset my WordPress password in the wp_users database, with the help of phpMyAdmin. There, I can see that somebody altered the login information to "indoxploit" and maybe the password MD5 hash was also altered, because when I searched it in google I got this page hit:


Then I simply added a new MD5 hash and then I was able to login to my WP admin dashboard, I updated the WordPress version to the newest one, and the plugins too. What to do besides these actions?


Nice job recovering your password, however, the exploit probably still exists so you might get hacked again.

Your next step is to find and seal up the security hole. It could be a plugin. It could be a theme.

Download and run the Sucuri plugin to help you figure it out.

| improve this answer | |
  • I installed the original WordPress about 1.5 years ago, and since then I didn't upgraded, maybe this is why it had a security hole, or exploit. – Konstantin Sep 13 '16 at 4:03
  • I tried to onstall Sucuri Malware plugin, but installation fails, maybe not compatible with the newest wordpress. – Konstantin Sep 13 '16 at 4:17
  • What a surprise, enlisted md5sum also belongs to word "indoxploit" as password. – Konstantin Sep 13 '16 at 4:37
  • Running an older WordPress version certainly could've been it. Versions >= 3.7 now include automatic updates which will help you going forward. Hope you got everything all sorted out. – cowgill Sep 13 '16 at 4:52
  • If I download the raw access log files from cPanel, how can find the attacker's IP (and his/her POST / GET requests) ? – Konstantin Sep 13 '16 at 5:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.