A sophisticated WordPress backdoor was discovered hidden in the mu-plugins folder, using ROT13 obfuscation to stealthily fetch and execute remote payloads, granting attackers persistent administrator access. The malware also creates hidden admin accounts and can change passwords to maintain control, making detection and removal very difficult. #WordPressBackdoor #ROT13 #officialwp
Keypoints
- The malware was found in the WordPress mu-plugins folder, which automatically loads plugins that cannot be disabled from the admin panel.
- It uses ROT13 obfuscation to hide the URL of its remote payload and stores the decoded malicious payload in the WordPress database to avoid detection.
- The malicious loader file, wp-index.php, fetches, decodes, and executes a base64-encoded payload dynamically, cleaning up traces immediately after execution.
- The remote payload includes a hidden file manager (pricing-table-3.php) and creates a hidden admin user named ‘officialwp’ with full administrative rights.
- The malware force-activates additional plugins downloaded from attacker-controlled servers to reinstate infection if deleted.
- It includes functionality to reset passwords of common admin accounts to a default attacker-set password, ensuring persistent access.
- The backdoor enables attackers to execute remote code, manipulate site content, and potentially steal data or launch further attacks.
MITRE Techniques
- [T1098] Account Manipulation – The malware creates a hidden admin user ‘officialwp’ and resets passwords of default admin users to maintain access. (“The user ‘officialwp’ is created and granted administrator rights.”)
- [T1505] Server Software Component – A hidden file manager (pricing-table-3.php) is injected to allow browsing, uploading, and deleting files. (“We found a hidden file manager injected into the theme directory as pricing-table-3.php.”)
- [T1059] Command and Scripting Interpreter – The loader executes PHP code remotely by downloading and running base64-encoded payloads from obfuscated URLs. (“This script acts as a loader, silently fetching a remote payload from a ROT13-obfuscated URL…The payload is included and then deleted immediately.”)
- [T1543] Create or Modify System Process – The malware force-activates downloaded plugins to reinstate infections if the original files are removed. (“This plugin also helps reinstate the infection if deleted.”)
- [T1005] Data from Local System – Uses database option key (_hdra_core) to stealthily store the payload, avoiding filesystem detection. (“The payload is saved in the WordPress options table under _hdra_core.”)
Indicators of Compromise
- [File] Malicious loader file – wp-content/mu-plugins/wp-index.php
- [Encoded URL] ROT13-encoded payload URL – str_rot13(‘uggcf://1870l4ee4l3q1x757673d.klm/peba.cuc’), which decodes to hxxps://1870y4rr4y3d1k757673q[.]xyz/cron.php
- [Database] Stealth storage key – _hdra_core option key used to store encoded payload
- [File] Temporary payload files – .sess-[hash].php files inside the uploads directory
- [User] Hidden admin account – officialwp
- [Encoded URL] ROT13-encoded reinfection plugin URL – wp-bot-protect.php decoded to hxxps://1870y4rr4y3d1k757673q[.]xyz/shp
Read more: https://blog.sucuri.net/2025/07/uncovering-a-stealthy-wordpress-backdoor-in-mu-plugins.html