update to the SQL structure was done on wp_head hook, so added a single curl to homepage before exploit