'timthumb' security disaster that made the wordpress community run Security hole that enables even the dumbest script-kid to compromise It wouldn't be the first time that a wordpress plugin introduces a major If it wasn't your login form, check your wordpress plugins. You might want to check that page for further information. The issue was so wide-spread that it even got a dedicated page at the wordpress website () where they posted some potential fixes to the problem. Many sites got hacked that way and I can imagine your webiste was one of them (although I can not be sure without taking a look at the server access logs). In case you missed the news: most recently there was a wide-spread brute-force attack on wordpress-based websites which targetted the wp_login.php file (your login form). Therefore a tip you should embrace: good login-names and login-passwords are at least 8 characters long, and should include a combination of letters, numbers, and punctuation characters (like dots, brackets, dashes, etc.). If the hacker needs to guess both the name AND the password, he'll lose time and resources and most probably also interest in trying to hack your site. What most probably is the origin of your 'was hacked' problem, is the use of insecure passwords and - what can be even worse - the use of the login-name 'admin', because that leaves only one guess open for a hacker. The only thing I could think of what Greasemonkey could be usefull for, is brute-forcing login forms. Yet, client-side javascript can't corrupt your server-side directly. Greasemonkey only allows client-side javascripts to be run (to modify the client-side behavior of websites or to automate some things). Reading your question and the related description, I can only say that I disagree with your colleagues 'Greasemonkey' theory.

Is it safe to use tampermonkey