A WordPress Backdoor That Rebuilds Itself: What It Means, and What We Checked

Imagine a small online shop in Penang. Its developer finds a strange plugin, deletes it, and the site looks clean. A moment later it is back. The shop is imaginary; the pattern is not. On 1 October 2026, security researchers at Sucuri described a WordPress compromise where “the same backdoor kept returning within seconds of every removal, no matter how carefully the visible files were deleted.”^[1]

The story travelled quickly once The Hacker News picked it up.^[2] Below is what was found, what it means in plain English for a business website, and what we did about it on the WordPress sites we look after, including what our check can and cannot tell you.

What the researchers found

Sucuri named the malware SC, after the “SC_” markers in the injected code. A backdoor is hidden code that lets an attacker get back into a site whenever they like. What makes this one unusual is how hard it is to remove. In Sucuri’s words: “The payload lives in at least eight places at once, spread across files, the database, and shared memory, and every one of those places can rebuild all the others.”^[1]

They describe the loop like this: “Delete the plugin and a drop-in rewrites it. Delete the drop-in and the theme rewrites it. Clean every file on disk, and the next page load restores the whole set from the database or from a shared-memory segment.”^[1]

Once it is running, Sucuri reports that it hides itself from the plugins screen, takes instructions through public blockchain gateways rather than one server that could be blocked, creates a hidden administrator account, and can inject JavaScript into the pages visitors see. On a shop, the researchers note, that “enables checkout skimming”, meaning stolen card details.^[1] Hidden administrator accounts turned up again a week later in a separate campaign; see WordPress 7.1.3 and the hack that hides its own admin account.

How did it get in? Nobody knows yet for this case. The Hacker News lists the usual routes: known flaws in WordPress, plugins and themes, weak passwords, compromised plugins, and insecure upload forms.^[2] The same report flags a separate, actively exploited flaw in the wpForo Forum plugin. The US National Vulnerability Database describes it as an SQL injection, a way to send the database commands it should never accept, affecting “all versions up to, and including, 2.4.14”, which “makes it possible for unauthenticated attackers” to pull sensitive information from the database. It is rated 7.5, High.^[3]

What it means for a business website

Our take, in three points.

1. “We deleted the bad file” is no longer a cleanup. Sucuri’s own conclusion is that “a modern WordPress infection can be a system rather than a file.”^[1] If someone fixes a hacked site by deleting what they can see, and it comes back, they haven’t finished. Sucuri lays out a strict order: neutralise the start-up trigger first, then clear the copies in the database and memory, then scheduled tasks and hidden admins, and only then the files.
2. Restoring a backup may not be enough either. The researchers found copies of the payload in the database and in server memory, and related variants using database triggers that recreate an admin account.^[1] A backup taken after the infection carries it with it. That is why several dated backups are worth more than last night’s alone.
3. The boring basics still decide most outcomes. Sucuri’s first prevention point is plain: “Most compromises we handle exploit known, already-fixed vulnerabilities in outdated components.”^[1] Our view: for most small business sites, the bigger risk is not clever malware but a plugin nobody has updated in months.

There is an SEO side too, and it is the part business owners notice last. Injected JavaScript and hidden pages can get a site flagged as hacked in Google, and cleaning up afterwards takes far longer than the infection did.

What we checked, on 4 October 2026

We ran a read-only check for the indicators Sucuri published across nine WordPress sites we look after, including this one. It looked for: a start-up (auto_prepend_file) line in .user.ini, php.ini or .htaccess; hidden dot-named PHP files in wp-content; “SC_” markers or packed code in the db.php and advanced-cache.php drop-ins and in the active theme; a plugin sitting in both the must-use and normal plugin folders; random hex-named ZIP files; sc_ options and very large encoded rows in the database; database triggers; administrators that exist in the database but don’t show in the user list; and the vulnerable wpForo plugin.

Result: none of the nine sites showed any of these indicators. Several sites do have an advanced-cache.php file; on each one it belongs to the caching plugin that site uses, with no SC markers. None of the nine runs wpForo.

What that does not prove: Sucuri notes that file names vary from site to site, and our check does not read server shared memory or watch outbound traffic. It is a screen for known signs, not a full forensic audit. We will keep updating plugins, watching for new advisories, and re-run the check if Sucuri or others publish new indicators.

What not to do

• Don’t just delete the file you found. With this family, that triggers a rewrite. Sucuri warns that deleting the start-up target carelessly can take down every PHP request on the account.^[1]
• Don’t restore last night’s backup and call it fixed. Check older backups, and check the database, not only the files.
• Don’t keep plugins you no longer use. A deactivated plugin still sits on the server, and an old forum or slider plugin is a common way in.
• Don’t share one admin login. Give each person their own account, so a strange administrator stands out.

Check it yourself

• Users: in WordPress, open Users and filter by Administrator. Do you recognise every name? (This malware hides its own admin from that list, so a clean list is a start, not proof.)
• Plugins: open Plugins and look for anything you don’t recognise, especially under “Must-Use”. Check that wpForo, if you use it, is above version 2.4.14.
• Updates: open Dashboard, then Updates. Anything waiting there for weeks is the real risk.
• A free outside scan: Sucuri SiteCheck scans what your site shows the public. It cannot see the server, so treat a clean result as a first check only.

Frequently asked

Is my WordPress site infected with the SC backdoor?

Most likely not, but you can only know by checking the server, not the front of the site. The signs Sucuri published include unexpected code in db.php or advanced-cache.php, an auto_prepend_file line in .user.ini or .htaccess, a plugin that appears in both the must-use and normal plugin folders, and an administrator who does not appear in the user list.

Why does malware come back after I delete it?

Because another copy rebuilds it. In this case copies sat in several files, in the database and in server memory, and each could restore the others. The fix is to remove every copy in the right order, then close the way in and change every password.

Will a security plugin stop this?

It helps, but it is not a guarantee. Sucuri reports that this backdoor can deactivate and delete security plugins once it is inside. Prompt updates, a firewall, separate admin accounts and regular checks of users and the database do more together than any single plugin.

Not sure about your own site?

Send us your website address. We will check the public signs, tell you which plugins and themes are out of date, and reply in writing with what to fix first. Request a free written review, or see how our WordPress maintenance and care plans work. If you are weighing whether WordPress is still worth it, we answered that in Is WordPress dead?

References

1. Gabriel Barbosa, Sucuri Blog, “SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor”, 1 October 2026. Accessed 4 October 2026.
2. Ravie Lakshmanan, The Hacker News, “WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory”, 1 October 2026. Accessed 4 October 2026.
3. National Vulnerability Database, “CVE-2026-1581” (wpForo Forum plugin), published 19 February 2026. Accessed 4 October 2026.
4. Total Web Solutions: read-only indicator check of nine WordPress sites we look after, run on 4 October 2026. Sites are not named.