I’ve Been Hacked

I am doing IT security for a long time. Backups, updates, patches, whatever needs to be done. I am also doing monitoring and that saved my butt.

My morning started after breakfast with a nice cup of coffee browsing through my emails. One got my immediate attention:

Verify database on webserver.

What? A script monitoring the database had detected some additions. The relaxed morning ended quite rapidly. I dumped the database and yes, two more admins had been added. Great. This WordPress installation had been compromised.

I mounted a backup disk and ran a script comparing the files on the backup and in the live installation. What I found confirmed what I already suspected. The attacker installed:

admin-utils-64f32ed287.php
direct.php
loot.php

which allowed him to access pretty much everything on the server under the UID of the webserver. Crap. I stopped access to the server, secured the compromised WordPress and synced with the backup to remove malicious files, than updated the wordpress installation (more about that in a minute). Finally I replaced the database with a “last known good”, changed the passwords, rotated the salts and terminated all possible current authorized connections. So far, so good.

Let’s see what happened:

I checked the logs and found the culprit:

/wp-json/batch/v1

which points to the wp2shell attack, combining CVE-2026-63030 (WordPress REST API batch-route confusion) and CVE-2026-60137 (SQL injection) to gain access to the installation. These vulnerabilities were 3 months old, my WordPress updates itself, so how could this old bug be used to compromise the site?