Responding to a suspected compromise

If you suspect stored XSS was exploited and an elevated account was compromised, follow a standard incident response:

1. Contain
   • Take the site into maintenance mode or disable the vulnerable plugin.
   • If possible at host level, isolate the site from the network.
   • Revoke or rotate compromised credentials immediately (reset passwords; rotate API keys).
2. Preserve evidence

   Snapshot site files and the database for forensic analysis before making destructive changes.

3. Identify changes

   Scan for unauthorized admin accounts, modified files, unexpected scheduled tasks, and webshells.

4. Clean

   Remove malicious files and injected scripts from database fields (posts, options, usermeta, postmeta). Reinstall WordPress core, themes, and plugins from trusted sources.

5. Restore

   Restore from a clean backup taken prior to the compromise where possible.

6. Harden

   Apply updates, enable 2FA for admins, restrict contributor behaviour, deploy WAF rules, and rotate salts (AUTH_KEY, SECURE_AUTH_KEY, etc.).

7. Monitor

   Increase logging and monitoring for at least 30 days post-incident.

A practical measure is to maintain a separate, offline-stored admin-recovery account that is not used on the public site; it assists recovery if primary admin sessions are compromised.

Post-incident hardening checklist

• Update WordPress core, themes, and plugins to the latest stable releases.
• Revoke active user sessions and force logouts for all users.
• Rotate credentials and API tokens.
• Enforce 2FA for Administrators and Editors.
• Ensure wp-config.php keys/salts are unique and regenerated.
• Restrict file permissions and disable PHP execution in upload directories where possible.
• Block unauthorised upload types (e.g., .php in /wp-content/uploads).
• Schedule regular malware scans and maintain off-site backups.
• Audit plugins for maintenance status and vendor reputation.

How to communicate this with your team and clients

For hosts, agencies, or multi-site managers, send a concise advisory:

• What happened: plugin and affected versions.
• Immediate action: update to 2.0.2 or disable the plugin if update is not possible.
• Short-term mitigation: restrict contributor access, avoid opening unreviewed content in admin, enable WAF rules where available.
• Timeline: when fixes were applied and follow-up actions (scans, audits).
• Contact: designate who to reach for suspicious behaviour.

Clear communication reduces confusion and prevents duplicated work during remediation.

Appendix: Useful WP‑CLI and admin commands (for defenders)

Run these commands during a maintenance window and with backups in place.

# List all plugins and versions
wp plugin list --format=table

# Update a specific plugin
wp plugin update social-post-embed

# Deactivate the plugin if you cannot update
wp plugin deactivate social-post-embed

# List users with role=contributor
wp user list --role=contributor --fields=ID,user_login,user_email,display_name

# Search posts for "