WordPress PHP hacks: how malware really gets in

A WordPress PHP hack is almost never a mystery virus. Someone gets code to run on your server, usually through a plugin hole, a poisoned update, or a file that looks like WordPress and is not. That code is PHP: a webshell, a backdoor, or a dropper that pulls more malware later. Recent cases from BleepingComputer, Sucuri and Wordfence show the same pattern. The attacker lands once, then leaves something that keeps working after you change the admin password.

What a WordPress PHP compromise looks like

WordPress runs on PHP. So does most of the malware that hits it. Once a PHP file can execute on your host, the attacker can read wp-config.php, create or hijack admin sessions, inject spam only Googlebot sees, or write more files into plugins, themes and uploads.

You will often find:

• A new .php file in wp-content/uploads, wp-admin/js or a plugin folder you did not install
• A plugin that never shows in the dashboard, or one that phones home on every page load
• Code stored in the database (for example in wp_posts) that still runs when the site loads it
• Spam, redirects or fake pages shown to search engines while the logged-in owner sees a normal site

If you only check the homepage while logged in, you will miss a lot of this.

Proof from recent public cases

In April 2026, BleepingComputer reported that more than 30 plugins in the EssentialPlugin suite shipped a backdoor after an ownership change. The backdoor sat inactive from August 2025, then began fetching malware that injected into wp-config.php and pulled spam, redirects and fake pages from a command-and-control server. WordPress.org closed the plugins and forced an update that cut the communication path. It did not clean already-infected wp-config.php files.

Credit: BleepingComputer: WordPress plugin suite hacked to push malware to thousands of sites (April 15, 2026)

In December 2025, Sucuri documented a PHP auto-login backdoor disguised as a JavaScript data file at wp-admin/js/mr_skk/data.php. Anyone who knew the URL became an administrator. No new admin user appeared in the dashboard. The script used WordPress's own login functions, so many logs looked ordinary.

Credit: Sucuri: WordPress Auto-Login Backdoor Disguised as a JavaScript Data File (December 10, 2025)

In September 2026, BleepingComputer covered active abuse of CVE-2026-27540 in WooCommerce Wholesale Lead Capture (versions through 2.0.3.1). An unauthenticated AJAX upload handler trusted a request-supplied allowlist, so attackers could add php and drop a webshell. Wordfence told BleepingComputer its firewall had blocked over 100,000 related attacks, with spikes in June, July and August 2026. The fix shipped in 2.0.3.2.

Credit: BleepingComputer: Hackers target WordPress sites via third-party WooCommerce plugin (September 15, 2026)

In June 2026, Sucuri's incident write-up described a fake plugin ("Beloved PBN") that injected Private Blog Network links, plus two PHP webshells stored inside wp_posts. File scanners that only walk the disk miss that. The shells had no authentication and could read or write anywhere on the server.

Credit: Sucuri: WordPress PBN Plugin Drops Dual Webshells via Database Injection (June 16, 2026)

What to check on your own site

Do this before you delete files.

1. Search Google for site:yourdomain.com and look for pages you did not write.
2. Open Search Console's Security issues report.
3. List WordPress users and remove accounts you do not recognize.
4. In hosting file manager or SFTP, sort wp-content/uploads and plugin folders by modified date. Flag unexpected .php files.
5. Compare installed plugins to what you actually use. Delete the rest, then update what remains from official sources.
6. Ask your host which PHP version you run. Stay on a release that still gets security fixes.

Changing the admin password alone does not remove a webshell. The file or database payload has to go too. For the cleanup order after a confirmed hack, see what to do when a website is hacked. If the site is broken after a plugin update rather than infected, use the plugin conflict checklist.

Cleanup, then stop the next one

A thorough WordPress cleanup backs the site up first, removes malware and backdoors from files and the database, reinstalls core, plugins and the theme from clean sources, resets passwords, keys and salts, and requests a Google Search Console review when spam URLs or warnings are involved. Ask for a written report of how the attacker got in. "It's fixed" is not enough.

Our WordPress malware cleanup starts at $249, paid in full before work starts, and usually takes one to three days. To keep plugins updated and backups off the same box that got hit, a care plan starts at $79 a month. Full prices sit on the pricing page. For a fixed quote or a short call, use contact or the studio home.

FAQ

Is a WordPress PHP hack the same as a virus on my laptop?

No. The malware runs on the web server. Your laptop can still be fine while visitors, or only Googlebot, hit infected pages.

Will deleting the suspicious plugin fix it?

Sometimes that removes the dropper. Often a second file or a database payload remains. Check uploads, wp-config.php, extra admin users and Search Console after you delete anything.

How fast can a cleanup finish?

Ortha's WordPress cleanup usually takes one to three days once work starts. Google's review of a security warning can take longer than the cleanup itself.

Do I need a full rebuild?

Not always. Many sites clean and harden in place. Rebuild when the theme is abandoned, the plugin stack is a mess you no longer trust, or reinfection keeps coming back through the same weak setup.