WordPress Backdoor That Rebuilds Itself: How to Clean It Properly

Security researchers from Sucuri discovered a new backdoor for WordPress called "SC" in September 2026. Dubbed SC, this malware hides itself in several locations such as .user.ini files, hidden PHP files within wp-content, a payload stored in the database, code injected into the theme's functions.php file, a must-use plugin, and shared memory segments.

Once active, SC can create hidden administrator accounts, inject JavaScript into pages, run arbitrary PHP, disable or delete other plugins, and hide itself from plugins lists and update checks. It uses the Ethereum blockchain to facilitate its activities, preventing a single domain from being blocked or taken down.

The malware is likely spread through vulnerable plugins or themes, weak admin passwords, compromised supply chains, or insecure upload features. However, the exact infection vector is unknown. Good housekeeping and thorough clean-up are essential to remove the malware completely. Simply deleting files is not enough, as other parts of the malware can regenerate.

To properly clean the site, one should put it in maintenance mode, take a full backup of files and database, and treat all logged-in admin sessions as untrusted. Check for suspicious files in mu-plugins, .user.ini, .htaccess, and theme code, and remove everything together. Restart PHP and remove malicious plugin entries and payloads stored in the database. Restart PHP, check users for unauthorized administrator accounts, and reset passwords and keys only after ensuring the site is clean.

To prevent reinfection, keep WordPress core, plugins, and themes updated, avoid nulled or pirated plugins, use unique strong admin passwords with two-factor sign-in, limit writing access to wp-content, enable file-integrity or malware scanning plugins, and maintain off-site backups. Following these steps can significantly reduce the risk of a WordPress site being compromised by the SC backdoor.