SQL injection
Anyone has expirience with SQL injection on your site? And how to remove it without having a backup:-).
Without a known-good backup you cannot prove every option, post, and file is clean. You can get a working site back; you cannot guarantee a quiet backdoor is gone. If the infection is deep (obfuscated PHP in uploads, poisoned must-use plugins, DB triggers you did not create), restoring from the host’s last clean snapshot and then patching is safer than hand-editing production.