Is it possible that a compromised WordPress database could somehow be used to re-infect a website?
I'm not talking about the hacker decoding user passwords and login into WP.
I'm talking about the hacker making use of a compromised database to re-infect a website WITHOUT having to login thru WP Admin.
Despite updating the WP core + plugins + cleaning the infected files, and changing all the passwords (server, database, WP salt, etc.), the site was re-infected.