wp-cli

The wp_options.siteurl hijack: how a one-row UPDATE redirects every visitor and how to spot it before Google does

by
Metal directional arrow plate on a wooden floor — photo by Max Laurell on Pexels

One of the simplest, oldest, and still most effective WordPress compromises is a single SQL update. The attacker gets one query into your database — through any RCE, SQLi, or stolen-credential path — and runs:

UPDATE wp_options
   SET option_value =
…