Listen to this Post
Introduction: The Hidden Danger Lurking in WordPress MU-Plugins
A new cyber threat is quietly compromising WordPress sites through a stealthy and hard-to-detect backdoor buried inside the mu-plugins directory. This highly persistent malware grants attackers full administrative access, letting them execute malicious actions without being seen by site owners or administrators. By exploiting a unique feature in WordPress architecture, cybercriminals have created an almost invisible gateway into thousands of websites, enabling long-term control and potential destruction.
This article breaks down how the attack works, why
the Stealth Backdoor Malware in WordPress
Cybersecurity researchers have recently identified a stealthy backdoor inserted into WordPress installations via the must-use plugins (mu-plugins) feature. These special plugins are auto-activated and stored in the wp-content/mu-plugins directory, making them nearly invisible to admins because they don’t appear in the WordPress dashboard and can’t be disabled through regular means. This makes them a prime target for hackers.
The discovered malware hides a PHP loader script named wp-index.php in the mu-plugins folder. This script fetches a second-stage malicious payload from an obfuscated URL using ROT13 encryption and stores it within the WordPress database (under the wp_options table as _hdra_core). Once retrieved, it writes and executes the code temporarily from disk.
The malware installs a hidden file manager named pricing-table-3.php into the theme directory, allowing threat actors to manipulate files remotely. It also creates a new WordPress admin user called officialwp, installs a malicious plugin (wp-bot-protect.php), and ensures its own survival by resetting passwords of typical admin accounts (admin, root, wpsupport) to values it controls.
The backdoor’s capabilities include:
Persistent remote access
PHP code execution
Data theft and file manipulation
Website defacement
Malware injection into visitor sessions
Admin lockouts for legitimate users
Experts warn this kind of malware is particularly dangerous because it doesn’t show up in plugin lists, and standard malware scanners may miss it unless the mu-plugin directory is audited.
To mitigate the risk, WordPress site owners should:
Update WordPress, themes, and plugins regularly
Enable two-factor authentication
Manually review mu-plugins and other core files
Limit admin privileges and monitor unusual activity
What Undercode Say: 🛡️ In-Depth Analysis of the Threat
Why MU-Plugins Are the Perfect Hideout
The core weakness lies in the structure of must-use plugins, a legitimate WordPress feature designed for crucial functionality. Attackers abuse this by placing malicious scripts in the mu-plugins folder, where they:
Run automatically without being listed on the admin dashboard
Avoid detection by casual users and many security tools
Cannot be disabled via the usual WordPress interface
This gives hackers both stealth and persistence, a combination that’s especially harmful.
Obfuscation and Payload Delivery
Using ROT13 ciphering to obscure the malware’s download URL helps avoid simple detection. Once decoded, the backdoor fetches payloads from remote servers, allowing:
Dynamic control: Hackers can change the payload at any time
Modular infection: Different malware strains can be injected as needed
Live updates: Attackers can evolve the threat without reinfection
The Role of the “officialwp” User
By silently creating a new admin account (officialwp), hackers ensure continued access, even if other admins are removed. This is reinforced by:
Password resets for key admin accounts
Download and activation of additional malicious plugins
Access to WordPress settings and file structure
This essentially gives full root-like control to the intruder, beyond what a regular admin might notice.
Multi-Stage Infection Strategy
The
1. Loader in `mu-plugins`
2. Database-stored malicious code
3. Theme-injected file manager
4. New admin user and plugin installer
Each layer ensures that even if one part is removed, others can reinitiate the infection, making manual removal extremely difficult.
Broader Implications
SEO sabotage: Infected sites can be flagged by Google, losing visibility and traffic.
Trust loss: Visitors exposed to malware may never return.
Legal risk: Sites that leak data or infect users may face compliance issues (e.g., GDPR, CCPA).
Reputation damage: Cleaning up post-infection often costs more than prevention.
Undercode’s Recommendations for Prevention
Audit all hidden directories like `mu-plugins`, `uploads`, and `themes`
Use security tools that support file integrity checks
Set up alert systems for new admin accounts or plugin installs
Monitor cron jobs and scheduled actions, which may be used for reinfection
Isolate admin access via IP or VPN restrictions
Backup regularly, but encrypt and validate backups before restoring
This malware exploits laziness and lack of visibility. The more a webmaster inspects and monitors their WordPress environment, the harder it becomes for such threats to survive.
✅ Fact Checker Results
✅ MU-Plugins run silently and automatically – confirmed
✅ Malware hides in obfuscated URLs using ROT13 – confirmed
✅ The backdoor creates new admin users and resets passwords – confirmed
🔮 Prediction
As awareness of this attack grows, hackers will likely adapt by:
Using stronger encryption than ROT13 to avoid detection
Targeting WooCommerce and membership plugins to steal payment data
Creating fake premium plugins that secretly install the backdoor
Meanwhile, WordPress may need to rethink the visibility and permissions of MU-plugins to prevent further abuse. Expect this attack vector to evolve, not disappear.
Website owners who ignore the mu-plugins folder do so at their peril.
References:
Reported By: thehackernews.com
Extra Source Hub:
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
