Cybersecurity
Security researchers detail self-repairing WordPress backdoor
Sucuri said a WordPress backdoor called SC kept restoring itself across files, the database and shared memory, while researchers also reported active exploitation of a wpForo plugin SQL injection flaw.
- Sucuri said it had analysed a WordPress backdoor it called SC, named from the SC_ markers in the injected content.
- The malware was spread across at least eight components in files, the database and shared memory, and those pieces could restore one another.
- Gabriel Barbosa said the payload existed in at least eight locations, and Sucuri said the code could hide from plugin lists and update checks, use Ethereum-based communication, create an administrator account and load extra code.
- Sucuri said it had not established how the site was first compromised.
- The article also said an unauthenticated SQL injection in the wpForo Forum WordPress Plugin, CVE-2026-1581, was being actively exploited, and Previdian had seen fewer than 20 attempts since 3 July 2026 from five attacker IP addresses in Bulgaria, Switzerland, France, the United States and Yemen.
Sucuri said it had analysed a WordPress backdoor it called SC, a name taken from markers embedded in the injected content. The company described the infection as spread across multiple copies rather than a single file.
Gabriel Barbosa said the payload existed in at least eight places at once across files, the database and shared memory. He said each copy could reconstruct the others if removed.
Sucuri said the code used a decoder rather than readable function names. It said the malware could conceal itself from the administrator plugin view and update checks, call home through Ethereum, profile the site, fetch more code, create an administrator account, run PHP and disable or remove chosen plugins.
The company said it had not worked out the initial entry method. It said likely routes included known WordPress, plugin and theme flaws, weak credentials, supply-chain compromise and abuse of upload features to place web shells on servers.
The article also said a high-severity unauthenticated SQL injection flaw in the wpForo Forum WordPress Plugin, CVE-2026-1581, was under active exploitation. Previdian said it had observed fewer than 20 attempts since 3 July 2026, coming from five attacker IP addresses in Bulgaria, Switzerland, France, the United States and Yemen.
Named in this story
People
- Gabriel Barbosa
- said the payload lived in multiple places and could rebuild itself
Companies
- Sucuri
- described the malware and the plugin exploit
- Previdian
- provided telemetry on the wpForo exploitation attempts
Products and systems
- SC
- was the codenamed WordPress backdoor discussed in the report
- WordPress
- was the platform targeted by the backdoor
- Ethereum blockchain
- was used for the backdoor’s command-and-control traffic
- wpForo Forum WordPress Plugin
- was reported as under active exploitation
How the source tells it
The piece was mostly a technical security report, with a mild alarmist edge created by metaphor-heavy descriptions of persistence and self-repair.
- alarm the infection was presented as a circular system with no easy removal point