WordPress Malware Clean-up & Security Hardening

GlobalTrust, a private-equity and advisory group, runs several WordPress sites on one shared IONOS hosting account, including globaltrust-am.com, globaltrustfamilyoffice.com and globaltrusttravel.com. On 24 September 2026 attackers used a newly published WordPress core vulnerability (CVE-2026-87902) to get in. This case study covers finding it, cleaning it, and locking the account down.

The problem

Two of the three main sites were showing “Access denied” to visitors. The cause was a hidden back-door file (a 32 KB web shell named admin.php) and a replaced index.php, planted on the hosting account on 24 September, only days after the WordPress fix was released. The same files had been copied into eight more locations on the account, including old sites nobody had opened for years. Because every site shared one hosting login, cleaning only the visible sites would have let the attacker back in.

The audit also found that WordPress, themes and plugins were out of date on every main site, no backups could be confirmed, an error log was readable by anyone, and a backup script that failed every Monday had silently filled the largest plan with temporary files.

What was done

• Audited 27 domains and 22 hosting contracts first, read-only, before changing anything.
• Took a full backup of each site before touching it.
• Found and removed the back-door files from all 10 locations on the account, including the two sites that were visibly broken.
• Updated WordPress core to 7.1.2 (the patched version), then every theme and plugin, on all three sites.
• Hardened the two exposed sites: no PHP execution in the uploads folder, XML-RPC off, public user list off, built-in file editors off, directory browsing off, WordPress version hidden.
• Removed the publicly readable error log.
• Moved one site from PHP 7.4 (end of life) to 8.3, and made sure nothing was left on the paid PHP 8.0 extended-support version.
• Switched off the failing backup script and cleared the 657 GB of temporary files it had left.
• Read the hosting invoices and flagged charges the client had not requested.

The numbers

Checked live on 15 October 2026 and in the IONOS control panel.

• Infected locations on the hosting account: 10 → 0.
• Space used on the largest plan: 672.9 GB → 15.7 GB.
• WordPress core: patched 7.1.2 on all three sites; theme and plugin updates: none pending.
• Sites back online: 3 of 3, with /admin.php returning 404.

What these numbers do not say: a full-site malware scanner kept timing out on the shared hosting, so I cannot call the account “guaranteed clean”. A partial scan of one site (about 18,800 files) found nothing more, and the back doors were removed by hand. That is why ongoing monitoring is part of the plan below.

What comes next

Monthly care for the sites: updates with a backup first, uptime and security monitoring, and hardening for the main company site, which was deliberately left for the care plan because it carries a custom SSL setup. A full malware scan will be repeated on a plan with more resources.

Visit the live site →