CERT24WordPress backdoor rebuilds itself using files, the database, and shared memoryLoading data…
CERT24Threat Observatory
Period

WordPress backdoor rebuilds itself using files, the database, and shared memory

Researchers described a WordPress compromise in which a backdoor named SC was placed in multiple files, the database, and a System V shared-memory segment. These components can rebuild one another, allowing the backdoor to return after files and the database have been cleaned. The backdoor can hide from WordPress administration screens, communicate with a command-and-control server through the Ethereum blockchain, create a hidden administrator account, execute PHP code, and retrieve JavaScript targeting site visitors. The source separately reports that an unauthenticated SQL injection flaw in the wpForo Forum WordPress Plugin, CVE-2026-1581, is under active exploitation.

← Back to intelligence

WordPress backdoor rebuilds itself using files, the database, and shared memory

Researchers described a WordPress compromise in which a backdoor named SC was placed in multiple files, the database, and a System V shared-memory segment. These components can rebuild one another, allowing the backdoor to return after files and the database have been cleaned. The backdoor can hide from WordPress administration screens, communicate with a command-and-control server through the Ethereum blockchain, create a hidden administrator account, execute PHP code, and retrieve JavaScript targeting site visitors. The source separately reports that an unauthenticated SQL injection flaw in the wpForo Forum WordPress Plugin, CVE-2026-1581, is under active exploitation.