I have a client with his wordpress site hacked. The hackers added new folder and files and changed the index.php. I would like to know if when this happens, Could the hacker add also malicious code inside the pages, posts, comments or even images? I suppose the hackers inject the code in common wordpress files like index.php or footer.php , something that is always displayed. Am I right?

marked as duplicate by Steffen Ullrich, S.L. Barth, André Borie, Anders, kasperd Nov 27 '16 at 12:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Browse other questions tagged or ask your own question.