Developer's WordPress Site Was Compromised Within 48 Hours Due to Weak Password

A developer discovered their WooCommerce test site had been compromised after noticing shop links were redirecting to empty search URLs, which turned out to be a symptom of a breach rather than a coding error. The site had been probed by automated scanners within hours of deployment, and a four-character password matching the username was cracked through credential wordlist attacks involving over 500 login attempts from roughly 20 IP addresses. Within seven seconds of a successful login, a script automatically created a rogue administrator account, and by that evening three separate parties had accessed the site as admin. The intruders deactivated seven plugins — including WooCommerce — to disable logging and security tools, inadvertently triggering the theme's built-in fallback behavior that alerted the developer. Because the site ran in an isolated container with the database unexposed to the host, the damage was contained and recovery involved a straightforward rebuild from a clean image.