Apparently, about two months ago, my blog got hacked (without me noticing) and infected with malicious code injected into the functions.php file of the twentytwentyfive theme. A block of base64-encoded PHP was being re-saved to my blog every time it got deleted, and through that code, the attackers managed to install malicious plugins and create two admin users :(

Luckily, since my blog runs in a Docker container, they couldn’t reach the OS level. But those plugins and admin users have been sitting there for over two months. I’ve since moved to a completely new server and tightened things up—disabling certain PHP functions (exec, shell_exec, etc.), restricting curl_exec at the network layer to only allow *.wordpress.org, and disabling file_get_contents via php.ini.

Still, this really shows how vulnerable WordPress is!