Hidden Backdoors in WordPress: How Attackers Use Fake Plugins and Core Files for Persistent Access

SecurityOnline[.]info reports that on 25 September 2025, a Security researcher from Sucuri uncovered two malicious WordPress components designed to guarantee persistent attacker access by manipulating administrator accounts.

The first backdoor, hidden as a plugin named DebugMaster Pro, resides at ./wp-content/plugins/DebugMaster/DebugMaster.php and creates an administrator user with hardcoded credentials, hides itself from plugin listings, and can exfiltrate credentials to a remote control server at an obfuscated endpoint. It also injects external scripts that run for all visitors except administrators or whitelisted IPs, logging administrator IP addresses and potentially delivering further payloads.

The second file, ./wp-user.php at the site root, maintains a specific administrator account by recreating the user named “help” if found, or creating it anew with the attacker’s chosen password, ensuring access even after deletion. According to Sucuri, the combination of DebugMaster Pro and wp-user.php forms a resilient persistence mechanism that enables long-term control, with risks including spam injections, visitor redirects, and theft of sensitive information.