You are a WordPress security expert. I have downloaded the entire source code of a suspected hacked WordPress website to my machine and opened it in an IDE. Please browse directly in this local workspace.\n\nPlease analyze and return:\n\n1. DANGEROUS FILES\n – Files containing: eval(base64_decode), gzinflate, str_rot13, assert(), preg_replace /e, system(), exec(), passthru()\n – .php files located in the uploads/ folder (unusual)\n – Files with random names or fake WP core names (e.g., wp-logln.php, hello.php)\n\n2. RECENTLY MODIFIED FILES\n – List files with unusual modified timestamps compared to the rest\n – Priority: functions.php, wp-config.php, .htaccess, index.php\n\n3. SPECIFIC MALWARE\n – Suspected code snippets, explaining what they do\n – Classification: backdoor shell / spam injector / redirect / credential stealer / cryptominer\n\n4. VECTOR CONCLUSION\n – Based on the location and type of malware, what could the attack vector be?\n – Which plugin/theme is likely the entry point?\n\nFormat: clear headings, for each dangerous file specify path + code line + severity (CRITICAL / HIGH / MEDIUM).

You are a WordPress security expert. I have downloaded the SQL dump file of a suspected hacked website to my machine and opened it in an IDE. Please browse this local file directly.\n\nPlease analyze the following tables and return:\n\n1. wp_options\n – Have siteurl or home been changed or had redirects inserted?\n – Are there suspicious plugins in active_plugins (unusual paths, non-existent plugins in wp-content)?\n – Are there any options containing suspicious base64, eval, iframe, or ?\n – Has admin_email been changed?\n\n2. wp_posts / wp_postmeta\n – Which posts contain spam keywords (viagra, casino, pharma, 카지노, 薬)?\n – Which posts have hidden iframes or hidden links (display:none, font-size:0)?\n – Post_status = publish but no title or unusual content?\n\n3. wp_users / wp_usermeta\n – Which users with the administrator role were recently created?\n – Unusual user_registered timestamps?\n – Are there user_logins that look like bots (random strings, fake emails)?\n\n4. CONCLUSION\n – Hack type: Pharma hack / Japanese SEO hack / Backdoor user / Option inject?\n – Infection level: how many records are affected?\n – What needs to be done to clean the DB?\n\nFormat: table for the list of infected users/options, clearly stating table + field + suspicious value.

You are a WordPress security expert. I have downloaded the access log (and/or error log) file of the web server to my machine and opened it in an IDE. Please browse this local file directly.\n\nPlease analyze and return:\n\n1. INCIDENT TIMELINE\n – When did the first request showing signs of attack appear?\n – What was the sequence of events from scan → exploit → backdoor upload?\n\n2. EXPLOITED ENDPOINTS\n – xmlrpc.php: is there brute force or multicall abuse?\n – wp-login.php: unusual request volume?\n – admin-ajax.php: suspicious actions?\n – Upload endpoint: were any PHP files successfully uploaded?\n – Which URLs returned 200 but look like shell paths?\n\n3. ATTACKING IPS\n – Which IPs showed unusual behavior (scanning multiple paths, continuous POST)?\n – List the top 10 suspicious IPs + number of requests + behavior\n\n4. PERSISTENCE SIGNS\n – After the initial attack, were there subsequent requests to backdoor files?\n – How many times did the hacker return, and from which IPs?\n\n5. VECTOR CONCLUSION\n – What is the most probable attack vector based on the logs?\n – Which plugin/path is the entry point?\n\nFormat: chronological timeline, IP list in table format, endpoints as a list with HTTP method + status code.