I have an old WordPress site that was on really bad shared hosting and has been hacked into smithereens. It's been compromised by multiple (different) people, as far as I can tell. It's pretty bad! The site is functioning well enough right now for me to get in and do things, so I'd like to move it to a different server if possible.
However, since I know it has backdoors and all sorts of trouble in it, I'm not sure how to move it over.
Obviously I'm going to do a fresh WP install, but is there a way to move the data (blog posts, comments, etc) over without a risk of also transferring a backdoor or some other trouble?
For example, do I need to worry about the MySQL databases themselves being compromised? Or if I manually move them would they be ok?
I am thinking the safest thing to do would be to do a WordPress "export" and then import the XML file to the new freshly-built site along with
.gif files. I'm assuming images are relatively safe. XML also seems pretty safe, but even so, it's a lot of code to scroll through, and I'm not sure if I would recognize a backdoor embedded inside it if there was one. Could it somehow have PHP embedded in a post's text that would then be activated on the clean site?