7 min read
How to remove malware from WordPress, step by step
A practical WordPress malware cleanup guide covering backups, core files, plugins, database checks, hidden access and validation with WP-CLI.
- Guides
- Malware
- Incident response
Research · Responsible disclosure
WordPress security in practice.
Guides for WordPress site owners (hacked, malware or Google spam) and CVE research writeups.
Recent writeups
5 published
7 min read
My WordPress site was hacked: what to do right now
Found malware, strange redirects or a warning on your WordPress site? Here's what to preserve, how to contain the damage and what to do next.
- Guides
- Malware
- Incident response
6 min read
Japanese keyword spam on WordPress: how to remove it
Seeing Japanese search results for pages you never created? Learn how to check WordPress for SEO spam, remove the infection and recover in Google.
- Google spam
- Malware
CVE-2026-62061 1 min read
CVE-2026-62061: IDOR in ProfileGrid
IDOR (CWE-639) in the ProfileGrid WordPress plugin up to 6.0.0.2. CVSS 5.3, fixed in 6.0.0.3, Patchstack advisory credited to Zenith.
- CVE
- WordPress
CVE-2026-103912 1 min read
CVE-2026-103912: reflected DOM XSS in JetFormBuilder
Reflected DOM XSS in JetFormBuilder up to 3.6.6 via query_var and data-jfb-macro. CVSS 4.7, fixed in 3.6.6.1, Wordfence advisory.
- CVE
- WordPress
More practical guides are available in Portuguese on the Portuguese blog.
From writeup to your site
Is your site showing these symptoms?
Send me the link on WhatsApp. I confirm the problem, scope and price before starting. If it's not a fit, I'll say so.