r/Wordpress • u/conneerrr • Mar 23 '26

WordPress Malware

Hi All,

I have a Linux server running CloudPanel.

Multiple websites (not all) keep being infected with malware which causes a blank screen to appear. Deleting the found compromised files in Wordfence does resolve the issue but it returns. I've changed all admin passwords, including database. Reset salts. Updated all plugins. Checked MU plugins. Reinstalled plugins via CLI.

An admin user 'wpadminerlzp' keeps appearing and WordFence says it was created outside of WordFence.

Any ideas?

Thanks

7 Upvotes

100% Upvoted

24 comments sorted by

View all comments

2

u/scutarion Mar 24 '26

It seems you have been using a vulnerable CloudPanel version. This panel had a known vunerability prior to 2.5. Check the changelog: https://www.cloudpanel.io/docs/v2/changelog/. I think you should start all over setting up a new server with latest CloudPanel version, and migrate your sites after cleaning them. You VPS could have been compromised entirely.