Ugh, just what I needed. One of the sites I maintain in my spare time got hacked. Thousands of spam posts.

Could have been much worse though, it looks like it was just one editor's account that was accessed. Probably a poor password. There appear to be no shady plugins or backdoors or anything.

PSA: In cases like this, also check for application passwords on user profiles. There were quite a few of those too, and I imagine they added all the spam through the REST API.

#WordPress #security