Loading story…
Researchers reported attackers are hiding malicious PHP code in WordPress sites’ mu-plugins directory, a location that loads plugins automatically and is often overlooked because entries do not appear in the standard administrative plugin view. In one observed intrusion, a file named wp-index.php in wp-content/mu-plugins/ fetched a second-stage payload from a ROT13-obfuscated URL, giving the attacker persistent access and the ability to execute remote PHP code on the compromised server.
Additional infections linked to the same technique included redirects to fake update pages, website defacement or content replacement, and webshell deployment. The reported impact ranges from remote code execution and privilege escalation to denial of service and full site compromise, prompting defenders to audit the mu-plugins folder, review indicators of compromise, keep WordPress components updated, enforce proper file permissions, and disable in-dashboard file editing in wp-config.php.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Sucuri published research describing attackers abusing WordPress's mu-plugins directory to hide malicious code that loads automatically and is not shown in the standard plugin interface, enabling stealth and persistence on compromised sites.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourceblog.sucuri.net
Open sourceblog.sucuri.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are deploying hidden backdoors on WordPress sites by disguising malicious files as legitimate plugins and core components. These backdoors enable persistent administrative access, even after other malware is removed. One technique involves a fake plugin, such as 'DebugMaster Pro,' which creates secret admin users and hides itself from detection. Another method uses files masquerading as core WordPress files to ensure a specific admin account with a known password is always present, automatically recreating the user if deleted. These tactics allow attackers to maintain long-term control over compromised WordPress sites, facilitating further malicious activities such as spam injection, redirection, or data theft.
Jun 29, 2026
Attackers tampered with JavaScript served from **Awesome Motive** infrastructure for the widely used WordPress plugins **OptinMonster**, **TrustPulse**, and **PushEngage**, triggering a supply-chain compromise that Sansec said exposed more than **1.2 million sites**. The malicious code activated only when a logged-in WordPress administrator visited an affected site, then stole authentication data, exfiltrated site details to the typosquatted domain `tidio.cc`, created rogue administrator accounts, and deployed a stealth plugin designed to hide from normal WordPress administrative views. Researchers said the hidden plugin provided **unauthenticated remote code execution** through a web shell and an `eval`-style endpoint, effectively giving attackers arbitrary PHP execution on compromised servers. Sansec verified malicious code in OptinMonster and TrustPulse CDN files beginning June 12 and said those paths were later cleaned, while some PushEngage CDN edges continued serving infected code until June 14; the exact initial compromise point remains unknown, but the distribution path ran through Awesome Motive-operated domains via BunnyNet CDN. Defenders were urged to treat any affected site with an administrator logged in during the exposure window as fully compromised, remove rogue users, search for hidden plugin directories, and rotate all administrator credentials and secrets.
Aug 11, 2026
A critical vulnerability in the WordPress **W3 Total Cache** plugin allows remote, unauthenticated attackers to execute arbitrary PHP commands on affected sites. Tracked as **`CVE-2025-9501`**, the flaw affects versions earlier than **`2.8.13`** and is tied to insufficient validation of user input in the plugin’s **`_parse_dynamic_mfunc()`** function. According to CSIRT.SK, the bug can be triggered through a specially crafted comment, creating a path to full system compromise on vulnerable WordPress installations. The issue carries a **CVSS v3 score of 9.0**, underscoring the risk to organizations running the plugin in production. Security updates were released by the vendor in **W3 Total Cache 2.8.13**, and defenders are being urged to upgrade immediately and review WordPress databases, site files, and logs for evidence of exploitation or malicious post-compromise activity.
Jul 24, 2026