A newly uncovered and highly sophisticated WordPress malware campaign is exploiting the “mu-plugins” (must-use plugins) directory, a location rarely monitored by traditional security tools, to establish persistent and stealthy access to compromised websites. The malware, identified as wp-index.php, abuses WordPress’s must-use plugin feature to ensure its execution cannot be disabled via the admin panel. Using advanced ROT13 obfuscation, the malware conceals its communication with command-and-control (C2) infrastructure, effectively flying under the radar of common security mechanisms.

According to the Researcher, upon execution, the malware connects to a remote server (hxxps://1870y4rr4y3d1k757673q[.]xyz/cron.php) to fetch base64-encoded payloads, which are then stored in the WordPress database under the key _hdra_core. This database-centric persistence approach bypasses conventional security tools that focus on file integrity, as the malware no longer needs to leave obvious file traces. It even uses temporary PHP files that are immediately deleted after execution, minimizing any forensic footprint. This method allows the malware to survive standard site cleanups and maintain continuous access.

Adding another layer of stealth, the malware creates a hidden admin user named “officialwp”, while modifying the WordPress UI through carefully crafted filter functions to hide its presence. One of the payload components includes a covert file manager, named pricing-table-3.php, embedded in the active theme folder and protected via an HTTP header-based custom authentication token (fsociety_OwnzU_4Evr_1337H4x!). This allows attackers to remotely access and manipulate files on the infected server under the guise of a legitimate plugin component.

Researchers discovered this backdoor during routine malware analysis, emphasizing its multi-vector persistence and unusually robust evasion techniques. By leveraging WordPress internals in creative ways such as the abuse of must-use plugins, concealed admin users, and database-based payload storage the threat actors behind this campaign have demonstrated an advanced understanding of the platform. Their tactics ensure long-term control over affected sites while rendering standard mitigation efforts largely ineffective unless the infection is thoroughly and manually investigated.