An online retailer taking card payments noticed that order notification emails had stopped arriving for some orders.
The site had been broken into more than two weeks earlier through a flaw in WordPress itself, and the attacker had been quietly building up access ever since.
A flaw in WordPress core, not a plugin
Most WordPress hacks come in through an out-of-date plugin. This one did not. In July 2026 researchers disclosed wp2shell, a pair of flaws in WordPress core that together let someone with no login create a new administrator account. WordPress released a fix the same day and pushed it out automatically to sites with automatic updates switched on.
This site did not get the fix. A single line in its configuration file had switched off automatic core updates, left over from troubleshooting work months earlier and never switched back. So while almost every other WordPress site was patched within hours, this one stayed on the vulnerable version. Automated attack tools were scanning for exactly that, and it was found roughly 36 hours after the flaw went public.
Two weeks of nothing, then a lot at once
The first thing the attacker did was create an administrator account. They did not log in and did not write a single file. Over the next two weeks they created seven more, each with a name designed to look like a system account, and left them sitting there.
Then, in the space of about a day, they added:
- A fake plugin posing as an Elementor add-on, with its own hard-coded password and a hidden "support" account it protected
