Loading story…
Attackers are deploying hidden backdoors on WordPress sites by disguising malicious files as legitimate plugins and core components. These backdoors enable persistent administrative access, even after other malware is removed. One technique involves a fake plugin, such as 'DebugMaster Pro,' which creates secret admin users and hides itself from detection. Another method uses files masquerading as core WordPress files to ensure a specific admin account with a known password is always present, automatically recreating the user if deleted. These tactics allow attackers to maintain long-term control over compromised WordPress sites, facilitating further malicious activities such as spam injection, redirection, or data theft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Follow-up reporting described attackers hiding WordPress backdoors inside fake plugins and files made to resemble legitimate utilities or core components, helping them evade detection and maintain persistence. Multiple outlets covered the same underlying findings about stealthy persistence mechanisms on compromised WordPress sites.
Sucuri reported a WordPress malware pattern in which hidden backdoors were used to create unauthorized administrator accounts, giving attackers persistent access to compromised sites. The report described the activity as an observed technique in the wild affecting WordPress environments.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityonline.info
Open sourceblog.sucuri.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported attackers are hiding malicious PHP code in WordPress sites’ `mu-plugins` directory, a location that loads plugins automatically and is often overlooked because entries do not appear in the standard administrative plugin view. In one observed intrusion, a file named `wp-index.php` in `wp-content/mu-plugins/` fetched a second-stage payload from a `ROT13`-obfuscated URL, giving the attacker persistent access and the ability to execute remote PHP code on the compromised server. Additional infections linked to the same technique included redirects to fake update pages, website defacement or content replacement, and webshell deployment. The reported impact ranges from remote code execution and privilege escalation to denial of service and full site compromise, prompting defenders to audit the `mu-plugins` folder, review indicators of compromise, keep WordPress components updated, enforce proper file permissions, and disable in-dashboard file editing in `wp-config.php`.
Aug 14, 2026
A supply-chain attack hit the **Essential Plugin** WordPress portfolio after the plugin business was reportedly acquired by a new owner who inserted a hidden backdoor into trusted add-ons used by thousands of websites. Researchers said the malicious code was added to `Countdown Timer Ultimate` version `2.6.7` in August 2025 as a PHP deserialization backdoor, then left dormant for about eight months before activating in early April 2026. Once triggered, affected sites contacted `analytics.essentialplugin.com`, received additional payloads, and had malicious code written into `wp-config.php`. The compromise allowed attackers to serve hidden spam links, fake pages, and redirects to Googlebot while remaining largely invisible to site owners. WordPress.org subsequently closed all **31** Essential Plugin entries in the plugin directory and pushed version `2.6.9.1` to remove the phone-home behavior, but reports warned that the update did **not** clean already-compromised `wp-config.php` files. Hosting providers and researchers urged administrators to manually inspect and remove any still-installed malicious plugins and persistence left on their servers, underscoring the risk that plugin ownership changes can turn established WordPress software into a malware distribution channel.
Jun 29, 2026
Attackers tampered with JavaScript served from **Awesome Motive** infrastructure for the widely used WordPress plugins **OptinMonster**, **TrustPulse**, and **PushEngage**, triggering a supply-chain compromise that Sansec said exposed more than **1.2 million sites**. The malicious code activated only when a logged-in WordPress administrator visited an affected site, then stole authentication data, exfiltrated site details to the typosquatted domain `tidio.cc`, created rogue administrator accounts, and deployed a stealth plugin designed to hide from normal WordPress administrative views. Researchers said the hidden plugin provided **unauthenticated remote code execution** through a web shell and an `eval`-style endpoint, effectively giving attackers arbitrary PHP execution on compromised servers. Sansec verified malicious code in OptinMonster and TrustPulse CDN files beginning June 12 and said those paths were later cleaned, while some PushEngage CDN edges continued serving infected code until June 14; the exact initial compromise point remains unknown, but the distribution path ran through Awesome Motive-operated domains via BunnyNet CDN. Defenders were urged to treat any affected site with an administrator logged in during the exposure window as fully compromised, remove rogue users, search for hidden plugin directories, and rotate all administrator credentials and secrets.
Aug 11, 2026