Filtered by tag: malware × Clear
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Matched: WordPress
Researchers have uncovered a WordPress backdoor dubbed "SC" that uses multiple persistence mechanisms — including files, the database, and shared memory — to reinstall itself after removal. Dubbed a "self-healing mesh" by Sucuri, the malware uses the SC_ markers in injected content and is designed to survive cleanup attempts by rebuilding itself through redundant infection vectors.
SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor
Matched: WordPress
A WordPress malware family dubbed "SC" persists by storing payloads across at least eight locations simultaneously — files, database, and shared memory — with each copy capable of rebuilding the others. This makes simple file deletion ineffective, as the backdoor returns within seconds. Notably, it uses blockchain data to control its backdoor, making command infrastructure difficult to block or take down.
Inside a Malicious, Stealthy WordPress Must Use Plugin
Matched: WordPress
Wordfence researchers identified sophisticated WordPress malware installed as a must-use plugin, disguised as a health-check tool. It uses custom string obfuscation, hides itself from the dashboard, creates concealed administrator accounts, harvests plaintext passwords, and spreads to other WordPress installations on the same server. Its command channel uses EtherHiding, reading attacker server addresses from Ethereum smart contracts, making takedown difficult. The malware exfiltrates payment credentials, admin sessions, and WooCommerce data, and can remotely update itself, remove plugins, or inject JavaScript. Detection signatures were released June 23, 2026.
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
Matched: WordPress
A ransomware developer has been sentenced, while a WordPress plugin vulnerability is being actively exploited. Mandiant released its 2026 AI risk report, and a bug bounty hunter was found using PhantomRaven malware. A critical SAP flaw is also drawing attention. An AI-driven attack dubbed Plugin4Shell targets WordPress plugins, and a separate critical SAP vulnerability poses significant enterprise security risks.
Third-party WooCommerce plugin hits WordPress sites with PHP backdoor abusing recently patched vulnerability
Matched: WordPress
A critical unauthenticated file-upload vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture Plugin is being actively exploited to deploy PHP webshells capable of full site takeover. Affecting versions 2.0.3.1 and older, the flaw was patched in February 2026, but Wordfence has blocked over 100,000 attacks across two surge periods. The plugin has around 20,000 active installations. Users should update to v2.0.3.2 immediately and check upload directories for suspicious PHP files.
Experts warn 2,000 hacked WordPress sites were secretly running a global crime ring
Matched: WordPress
Security researchers have discovered around 2,000 compromised WordPress sites being used as infrastructure for a global cybercrime operation. The hacked sites served multiple roles: delivering malware to victims, acting as command-and-control servers for infected devices, and storing stolen data. The operation exploited the sites' legitimate reputations to avoid detection.
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Matched: WordPress
A cybercrime operation called StopAndProtect has compromised nearly 2,000 WordPress sites to distribute malware and collect stolen data. Rather than using a single malware strain, the campaign deploys a full toolkit of criminal software, using the hacked sites as infrastructure to spread infections, control compromised systems, and store stolen documents, screenshots, and activity logs.
WordPress Plugins Compromised Without a Single File Change
Matched: WordPress
Attackers backdoored WordPress sites by injecting malicious code into a third-party JSON feed consumed by plugins, rather than modifying plugin files directly. Because no plugin files were altered, standard file-integrity checks failed to detect the compromise. The attack highlights the risk of plugins that pull external data, as that data can serve as an infection vector bypassing conventional security monitoring.
PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response
Matched: WordPress
A supply chain compromise was discovered in the BdThemes WordPress plugin ecosystem, reported to Wordfence on August 7, 2026. The attack involved a poisoned API response affecting multiple plugins from the vendor. All affected plugins have been temporarily closed in the official WordPress plugins directory while the WordPress Plugins team conducts a full inspection and ongoing investigation.
WordPress Site Down? Here’s How to Get Back Online
Matched: WordPress
When a WordPress site goes offline, causes typically include plugin conflicts, server issues, database errors, expired domains, SSL problems, traffic spikes, or malware. Most outages are fixable without data loss. Quick diagnosis and targeted fixes can restore the site before significant damage to sales, leads, search rankings, or visitor trust occurs.