Wordfence Uncovers Self-Healing Malware in WordPress Must-Use Plugin on One Site

Key points

• Unidentified attackers installed a malicious must-use plugin on one WordPress site.
• The malware persists, reinstalls itself, and survives attempts to delete it.
• Wordfence identified the compromise; no CVE has been assigned.
• The intrusion was observed from mid-June through September 2026.
• Administrators should manually audit mu-plugins and rebuild from clean sources.

In mid-June, an unattributed threat actor compromised a single WordPress installation by deploying a malicious must-use plugin. The security firm Wordfence identified the malicious code, which is designed to be persistent. Unlike regular plugins, must-use plugins load automatically and cannot be deactivated from the WordPress dashboard, making them an attractive hiding spot for attackers.

The malware exhibits self-healing behavior: if removed, it reinstalls itself. It also resists standard removal attempts. As of September 2026, the malicious component had apparently survived efforts to delete it. This persistence mechanism means that simply deleting the plugin file may not be enough to eradicate the infection.

Only one site has been reported as affected, but the technique could be replicated elsewhere. Because no CVE has been issued, signature-based scanners and vulnerability databases may not flag this specific threat. Site owners should therefore rely on file integrity monitoring and manual inspection of the wp-content/mu-plugins directory.

Must-use plugins are always executed, often without appearing in the normal plugin list. Attackers can hide code there to maintain long-term access. In this case, the combination of self-repair and removal resistance suggests a deliberate effort to stay resident on the server.

What to watch: administrators should check for unexpected files in mu-plugins, review scheduled tasks and database entries for hidden reinfection routines, and be prepared to restore from a known-good backup or rebuild the site entirely. Continued monitoring through late 2026 is advised, as the threat may reappear if any persistence mechanism is missed.

What to do now

1. Immediately inspect the wp-content/mu-plugins directory for any unfamiliar PHP files and compare them against a known-good baseline.
2. Manually remove suspicious must-use plugins, then check for and eliminate any reinfection scripts in cron jobs, database options, or other core files.
3. Change all WordPress admin, database, FTP, and hosting panel credentials to revoke any lingering attacker access.
4. Reinstall WordPress core, themes, and plugins from official clean sources; do not reuse any files from the compromised site.
5. Restore the site from a backup taken before mid-June, or rebuild it from scratch if no clean backup exists.
6. Deploy a file integrity monitoring solution and review logs regularly for unauthorized changes to mu-plugins or other critical directories.
7. If reinfection occurs, consider migrating the site to a new server and hardening it with strict file permissions and a web application firewall.

Original source

Wordfence