without looking at the server nobody can tell you how bad it is nor how to fix it. most replies were from people as cluless as you if it comes to security, no offense
i mean yes nulled scripts often contain backdoors but never "encrypted viruses" lol
just FYI i'm not talking out of my ass, i do penetration tests (also for fortune 500 companies) since the 90s so i've seen thousands of hacked servers over time...
first of all if its wordpress then there are many entry points. there are tons of vulnerable plugins and themes, these plugins are usually coded by people who have no or very little clue of security.
that being said, it might not have been wp at all. deppends on what other services are running on the server. maybe an outdated ftpd, smtpd, pop3d, imapd? or did you run other domains that have php scripts?
offten times people also have "secret" php scripts somewhere as they think if its not indexed by searchengines, nobody can find them, which is of course wrong..
or maybe some "test" install of wp somewhere left over?
if you have a bit of linux knowledge, login via ssh and check for newly created, or edited php files in the directory where the hacked site is hosted. since you said its a tube site, it is very likely that the upload mechanism is exploitable to upload files other than images or videos. so i'd check the upload, cache and temp directories (if they exist).
@daruelez sorry to say, but weak passwords are VERY common in the IM world
i offten tell customers to set better passwords and they go "why its only for a <PBN,porn,mfa,enter whatever here> site?" ..some honestly set 4-5 char passwds!! many compromised wp installs are due to bruteforce as admins think its clever to set passwords like "password1", "mydomainname1" or "123456789". seriously
