Security firm Sucuri has documented a newly identified WordPress backdoor, codenamed “SC,” built as a self-healing mesh that persists across eight separate locations spanning site files, the database, and server memory — a design that defeats the standard cleanup step of deleting a single flagged plugin or theme file.
Eight Persistence Points Create a Self-Healing Infection Loop
Sucuri identified the backdoor’s persistence points as a .user.ini file that auto-prepends a PHP loader, multiple hidden PHP files scattered across wp-content, an encoded payload stored directly in the WordPress database, injected code in WordPress theme functions, malicious must-use plugins, malicious standard plugins, and, on compatible servers, payloads stored in shared memory segments.
Sucuri researcher Gabriel Barbosa described the design in blunt terms: “Delete the plugin and a drop-in rewrites it… The result is a circular system with no single point you can remove to stop it.” That circularity is what distinguishes SC from typical WordPress malware — removing any one infected component does not end the infection, because the remaining seven simply regenerate whatever was just deleted.
Must-Use Plugins Give SC a Persistence Point Most Admins Never Check
Among SC’s eight persistence mechanisms, the malicious must-use plugins stand out because of where WordPress loads them. Must-use plugins run automatically on every page request without appearing in the standard plugin list that site administrators typically review, giving SC’s operators a recovery path that most routine security audits would never think to inspect in the first place.
Combined with the database-stored payload and, where available, the server’s shared memory segments, the must-use plugin mechanism gives SC multiple independent recovery paths even after an administrator successfully identifies and removes the more visible file-based components like the .user.ini loader or the injected theme code.
SC Communicates With Operators Through Ethereum Blockchain Infrastructure
Sucuri found that SC uses Ethereum blockchain infrastructure for command-and-control, a design choice that complicates takedown efforts because blockchain-based infrastructure cannot be seized or taken offline the way a conventional command server can. Once installed, the backdoor is capable of creating rogue administrator accounts, injecting malicious JavaScript, executing arbitrary PHP code, and manipulating plugins on the infected site.
Sucuri Has Not Identified How Sites Are Initially Infected
Sucuri’s research did not identify the initial infection vector for sites compromised by SC. The firm noted that typical vectors for this class of attack include vulnerable plugins and themes, weak administrator credentials, supply-chain compromise, and insecure file uploads — but it stopped short of confirming which, if any, of those paths SC’s operators actually used to reach the affected installations.
Sucuri discovered the backdoor during incident-response work in September and published its research write-up on October 1. In the same research, Sucuri separately noted that an unrelated plugin flaw, CVE-2026-1581 in wpForo, has seen fewer than 20 exploitation attempts since July 2026 — a minor data point the firm flagged as unconnected to the SC campaign rather than a standalone incident.
Why Conventional WordPress Cleanup Fails Against SC
Because SC is engineered specifically to survive the removal of any single infected component, the standard WordPress malware-removal playbook — delete the suspicious plugin, update the theme, scan for malicious files — is likely to fail outright against it. An administrator who deletes the malicious plugin and confirms the site looks clean may simply be watching the must-use plugin or the database-stored payload quietly rebuild what was just removed, creating a false sense that an active infection has been resolved.
Sucuri has published technical indicators publicly, but full eradication requires addressing all eight persistence mechanisms simultaneously rather than sequentially, since remediating any subset leaves enough surviving components for the backdoor to regenerate itself. The firm’s guidance points toward a comprehensive forensic review covering files, the database, theme code, installed plugins, and server memory together — not a one-step fix, because there is no vendor patch to apply against malware behavior rather than a single software vulnerability.
Blockchain-Based Command-and-Control Removes a Key Defender Advantage
Defenders responding to a conventional backdoor can often disrupt it by identifying and reporting the command-and-control server to hosting providers or registrars, cutting the malware off from its operators even if some infected files remain. SC’s use of Ethereum blockchain infrastructure for command-and-control removes that option: there is no single server or domain for defenders, researchers, or law enforcement to report, because the infrastructure is distributed across a public blockchain that no single entity controls or can take offline.
That design choice reflects a broader pattern of malware operators adopting decentralized infrastructure specifically to resist the takedown mechanisms that have traditionally disrupted command-and-control channels. For site owners, it means that even a complete, successful removal of all eight persistence mechanisms would not by itself eliminate SC’s ability to resume communication with its operators if any single component survives the cleanup — reinforcing why Sucuri’s guidance treats simultaneous, full-stack remediation as the only reliable path rather than an incremental one.
