Today I noticed three of my WordPress sites were hacked and were redirecting visitors to other sites. It took me a while to figure out what exactly was changed. Apparently, "siteurl" and "home" were changed in the wp_options table.
I'm not entirely sure which version of WordPress these specific sites used, but since I check for a new WordPress version at least once a month, it must have been 5.4.x. Oddly enough, one of the hacked sites says it's using v4.9.8. I can't (easily) check the others since I have not yet gained control of the Dashboard.
So how did this happen? Was this a known vulnerability in WordPress or perhaps one of its plugins? How can I investigate this further?
Edit: I also just noticed most (if not all) posts have been changed and also redirect to other sites.
Edit 2: I checked all WordPress files and none were world-writable but I did see one glaring mistake I made and which all hacked sites had in common. Of all those three sites I edited wp-config.php by hand leaving a world-readable backup (wp-config.php~) behind. This file contains the WP database's user and password. But I still don't understand how they used that to change the database. How did they gain access to MySql?