One of my sites was also hacked. Only the first post (title and body) was hacked with new content. Hacked title said “HaCkeD By MuhmadEmad”.
I deleted the post and reposted the overwritten post. About 6 hours later it reappeared, once again overwritting the first post.
This same hack appeared in the last couple days across many sites worldwide (ZDnet, National Treasury Management Agency, Dutch, Belgian, and other European sites).
If you google, “HaCkeD By MuhmadEmad”, you’ll find hundreds of pages that have been hacked. I don’t know if they are all WordPress sites.
I was on 4.7.1 for both hacks. Currently on 4.7.2 and trying to figure out how the hack worked while I see if it reappears.
Any insight would be greatly appreciated.
