Cybersecurity researchers have discovered threat actors using WordPress’s “mu-plugins” directory to conceal malware, enabling persistent remote access and visitor redirections to fraudulent websites.
## What Are mu-plugins?
Must-use plugins (mu-plugins) reside in the “wp-content/mu-plugins” directory and automatically execute without requiring activation through the WordPress admin dashboard. This characteristic makes them particularly attractive to attackers.
“This approach represents a concerning trend, as mu-plugins are not listed in the standard WordPress plugin interface, making them less noticeable and easier for users to ignore during routine security checks,” explains Sucuri researcher Puja Srivastava.
## Three Types of Malicious Code Identified
Sucuri has identified three variants of malicious PHP code in compromised mu-plugins directories:
1. **redirect.php**: Redirects visitors to external malicious websites while avoiding detection by search engine crawlers
2. **index.php**: Functions as a web shell, allowing attackers to execute arbitrary code by downloading remote PHP scripts from GitHub
3. **custom-js-loader.php**: Injects spam content, replaces images with explicit content, and hijacks outbound links to malicious sites
The redirect.php script often disguises itself as a browser update to trick users into installing data-stealing malware.
## Ongoing WordPress Threats
Attackers continue to use compromised WordPress sites to:
– Deploy fake CAPTCHA verification screens (known as “ClickFix”) to deliver Lumma Stealer malware
– Inject malicious JavaScript that redirects visitors or steals financial information
## Most Exploited Vulnerabilities in 2024
According to Patchstack, four critical WordPress vulnerabilities have been routinely exploited this year:
– CVE-2024-27956 (CVSS 9.9): SQL execution vulnerability in WordPress Automatic Plugin
– CVE-2024-25600 (CVSS 10.0): Remote code execution vulnerability in Bricks theme
– CVE-2024-8353 (CVSS 10.0): PHP object injection vulnerability in GiveWP plugin
– CVE-2024-4345 (CVSS 10.0): Arbitrary file upload vulnerability in Startklar Elementor Addons
## Protection Recommendations
WordPress site owners should:
– Keep plugins and themes updated
– Regularly audit code for malware
– Enforce strong password policies
– Deploy web application firewalls to block malicious requests and prevent code injections