STEP 1 – Find out Vulnerabilities in WordPress Website
If your website has been hacked or you want to make sure no one can hack this, you must take a look on plugin files and their coding. Might be somewhere coder is using sql queries without awareness of SQL Injection way to hack wordpress website. If this is somewhere, hacker will use union query and can fetch your all database rows from wp_users table and below is an example query to fetch all wordpress users using union query to know email addresses of all users.