Hackers Exploit WordPress Sites by Silently Injecting Malicious PHP Code

Cybercriminals have ramped up attacks on WordPress websites by stealthily modifying theme files to serve unauthorized third-party scripts, with the campaign using subtle PHP injections in the active theme’s functions.php to fetch external code. A single line of code referencing porsasystem[.]com was found to unravel the attack, and PublicWWW searches showed the same script present on at least 17 different WordPress sites, indicating a widespread operation targeting vulnerable installations.

According to VirusTotal analysis, 17 security vendors had already blocklisted the malicious domain for distributing harmful content, while the JavaScript payload loaded ads and redirected traffic through cloaking techniques, complicating removal. The infection chain hides in plain sight: a deceptive snippet appended to the bottom of functions.php that dynamically constructs a remote URL and uses wp_remote_get to fetch and echo JavaScript on page loads.

The breach was first noticed when a site owner observed unfamiliar JavaScript being executed on pages, and a recent client discovery highlighted that every visitor loaded malicious scripts from attacker-controlled domains. Mitigations include regular file integrity checks, least-privilege access, secure update workflows, manual code reviews, and deploying a Web Application Firewall with real-time monitoring. According to gbhackers, vigilance and code hygiene are essential to safeguarding WordPress sites against this stealthy compromise.