WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

Sucuri researchers have detailed a newly discovered WordPress malware strain, dubbed SC, that survives cleanup attempts by storing redundant copies of itself across at least eight locations: plugin files, a fake mu-plugin, theme code, drop-ins like db.php and advanced-cache.php, a ZIP backup, a database entry, and a System V shared-memory segment in RAM. Removing one copy triggers the others to silently rebuild it on the next page load, and the malware uses obfuscated code plus an Ethereum-based command-and-control channel to hide, create rogue admin accounts, inject skimmers, and execute arbitrary PHP. How the initial infection occurs is still unclear, though common WordPress attack vectors such as vulnerable plugins, weak credentials, and insecure upload features are suspected. Separately, Previdian has observed active exploitation of CVE-2026-1581, an unauthenticated SQL injection flaw (CVSS 7.5) in the wpForo Forum plugin affecting all versions up to 2.4.14, with under 20 attack attempts seen since July 3, 2026 from IPs in Bulgaria, Switzerland, France, the US, and Yemen.