Hackers Deploy Stealthy Malware on WordPress Sites to Gain Admin Access

Attackers have stepped up their tactics by deploying stealthy backdoors disguised as legitimate WordPress components, giving hackers persistent administrative access even after other malware is discovered and removed. During a recent site clean-up, two malicious files were uncovered, each masquerading as standard WordPress code but designed to manipulate administrator accounts silently, one located at ./wp-content/plugins/DebugMaster/DebugMaster.php and the other at ./wp-user.php at the WordPress root.

The DebugMaster Pro backdoor creates a secret administrator user with hardcoded credentials and then hides that user from the plugin list while reporting credentials to a remote command-and-control server in JSON, Base64-encoded form. The wp-user.php backdoor continuously checks for the presence of that admin account and, if found, deletes and recreates it with the attacker’s password, restoring administrator privileges on each run.

Administrators are also exposed to JavaScript injection into visitor pages (excluding admins and whitelisted IPs), enabling potential redirection or data harvesting. Website owners are urged to audit plugin directories and core files, enable file integrity monitoring, and review administrative accounts to defend against these silent campaigns.