Disabling plugins won’t help if WordPress core has been compromised (and reinstalling WordPress won’t do much good if your hosting account has been compromised).
I would recommend nuking and paving your installation with help from your hosting provider (and getting a professional to audit any necessary themes and plugins you plan to use after this is completed to ensure this doesn’t happen again).
Related Posts:
- What’s the effect if this malware if infected your WP?
- Malware on site [closed]
- How to find the backdoor of the hack
- My wordpress site was hacked – is my htaccess file compromised?
- My WordPress Blog sends malicious traffic to other sites [closed]
- Hacked WordPress website, as notified by Google Search Console, what to do? [closed]
- How was my WP site hacked [closed]
- If a WP install is hacked, can it spread to other domains on a server?
- Find and Replace text in the entire table using a MySQL query
- Is it a good idea to rename the “index.php” in “wp-admin” folder to avoid being hacked?
- How to fight this wp-info.php exploit? [closed]
- Prevent Hacking of WordPress Site [closed]
- Suspicious URLs being loaded after hack and restore
- Server hacked: correct contents of wp-uploads directory? [closed]
- Site hacked with malware [closed]
- Copy wordpress website pages and content
- How do I know if my WP Theme is using infamous TimThumb?
- Spam pages hack? [closed]
- Check for malicious code?
- Why would a hacker add this code to each post, and how to do mass cleanup?
- Is the current spate of hacks related to the recent security fix?
- I have removed the malware from our website however, when I tried again to search the word from Google it is still there [closed]
- Have I been hacked? Mysterious code at the top of theme files [closed]
- Strange codes in my wordpress site and my website is running too slow [closed]
- Spam Content Serving from old cached version of site?
- How to solve wordpress redirection (no malware was found)?
- Help determining if the following are legitimate files
- My blog was hacked? WP posting random posts
- Have I been hacked – getting new site setup email for 8 localhost wordpress sites
- malware in wordpress installer on dreamhost. [closed]
- Where I can find a list of WordPress security risks?
- looking for indoxploit hack solution [closed]
- Why functions.php file automatically empty?
- Bruteforce attack from 127.0.0.1?
- WordPress installer attack
- Why wordpress is hitting another url
- Where do hackers usually run their hacking script? [closed]
- Malicious Code in Index.php WordPress [closed]
- WP Site Hacked, Serp Google Spam [closed]
- My site appears to be hacked [closed]
- WordPress Redirect Hack
- Strings of malicious code to look for after a hack
- Hacked/cloaked sitemap [closed]
- Not able to change WordPress admin email. Someone added another admin credentials
- My WordPress Website Redirect to bigbricks.org and other site
- wordpress sites get hacked
- How to fix hacked website
- Verifying that I have fully removed a WordPress hack?
- If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
- WordPress site hacked. Has .htaccess been hacked?
- Tips for finding SPAM links injected into the_content
- Scanning Database for malicious Data
- How Attackers write script into my php files?
- Is this a hacking script in function.php?
- What should I do about hacked server?
- Websites defaced by uploading script using theme editor
- How can I find security hole in my wordpress site?
- Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?
- Restrict access to xmlrpc.php
- How to prevent bot or someone to modify any file automatically?
- Hacked website redirect, only on desktop, help with restoring it [closed]
- How do i disable/disallow and tags in TinyMCE?
- Change WP-Login or WP-Admin
- hSite has no css on mobile [closed]
- How to mass delete one line from all posts after site hack
- Unfamiliar query string in Google Search Console URL not found
- Strange gibberish JavaScript in Editor – site hacked?
- wp-config.php modified?
- Security issues with WP sites
- Suspicious Files
- Invisible spam post in backend
- How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
- Files automatically added
- How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
- You appear to have already installed WordPress. To reinstall please clear your old database tables first
- Increased CPU load due to admin-ajax.php spam
- getting casino links on my woocommerce site [closed]
- How to locate & delete hidden pages on a site
- sitemap contains weird links and does not contain my pages [closed]
- Malware script in database post table only? [closed]
- New user is assigned 2 roles: customer and superadmin
- Verifying that I have fully removed a WordPress hack?
- How can I safely hide the fact that my website runs on WordPress? [closed]
- Hacked WordPress website /Homepage redirect [closed]
- WordPress Footer Missing After Website Hack
- wp-admin folder removed by hacker [closed]
- My WordPress Websites are always under attack
- What is this code in my theme’s footer.php causing chmod permission warnings? [closed]
- Spam users registers even when registration is disabled
- What does this code do? (Injected code hacked)
- My WordPress website was hacked [closed]
- Hack-Proof OR Security in WordPress — is it real?
- How to find exploited wordpress plugin [closed]
- Some one is trying to hack my website, Need guidance [closed]
- Efficient way to check local WordPress php files and Database for malicious code? [duplicate]
- Is wp-app.php or wp-apps.php needed for WordPress?
- What can I do when an outside party hacks into my weblog and changes my display name?
- Troll the hackers by redirecting them
- Any known bugs that could cause disappearance of the wp_users table?
- Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?