WP3.XYZ malware attacks add rogue admins to 5,000+ WordPress sites

Researchers at c/side discovered a malware campaign leveraging the wp3.xyz domain that has compromised more than 5,000 WordPress sites by creating a hard-coded rogue admin account (wpx_admin), installing and activating a malicious plugin (plugin.php), and exfiltrating administrator credentials and logs via obfuscated requests that mimic image traffic; site owners are advised to block wp3.xyz, review privileges and plugins, strengthen CSRF protections, and implement MFA.