Cybercriminals make money through ransomware, spammy backlinks, and collecting and selling people’s data (even card info). The most common WordPress malware changes a website so that when certain visitors come to it they are redirected to a spam website that usually asks the viewer to click something or answer a question which can then infect that person’s device.