Any tips to cleaning after site hacked by wp2shell

Ruriko

My site was recently hacked by wp2shell so I decided to delete whole site directory and restore an older backup as it was the most safest approach rather than manually checking for malicious files. Is there anything else I need to check outside the wordpress directory if they injected anything maliciously? would they even be able to access outside the defined wordpress directory remotely if using the default wordops configuration

marty

A server restore would be safer if you have it (but take it offline and update WP etc before putting back online or it will just get hacked again).
If no server level backup is available, then you also need to restore the database if you didn't (likely extra admin users and who knows what else hiding in there). If there's more than one site on the server you also need to worry about all other sites too as WO never quite got to implementing secure separation of sites.