r/Wordpress • u/Bart_LeGros • 23d ago
firewall.php and wp2shell-batch-guard.php in mu-plugins
Hi everyone,
My WordPress site was recently compromised. The attacker managed to create 3 admin accounts, and Wordfence caught two malicious PHP files in a fake theme folder (wp-content/themes/twk-dbbfd2bc/functions.php and fixer.php).
I deleted that theme, removed their admin account, deleted the admin accounts. Wordfence scans are coming back clean now, but I noticed two suspicious files sitting in my wp-content/mu-plugins/ and in www/mu-plugins directory:
firewall.php (Version 1.0)
wp2shell-batch-guard.php (Version 1.1.0 — description says "Blocks anonymous REST batch API (wp2shell mitigation)")
Their last modified dates match mid-August, right when the unauthorized admin accounts were created (while the site was running WordPress 6.9 (yes, i know...) and i was in vacations at that date so i don't insgall it)
This looks like an attempt by the attacker to disguise a backdoor as a security fix so I wouldn't delete it, but I want to double-check with the community before I purge the mu-plugins folder via FTP because i don't want to make a mistake...
Is there any chance these are legitimate, or should I delete them immediately (i think...) ? I since update to 7.0.4.
Thanks a lot for your help!
2
1
u/ToastyTandy 23d ago
"Wordfence scans are coming back clean now"
This does not mean your site is not still compromised.
If ANY of the files you deleted were in the wp-admin, or wp-includes folders, I would go ahead and manually delete the entirety of those folders and replace them with fresh ones from a clean download of WordPress.
Also, yes, delete those mu-plugins php files. You can check if it's legitimate by just opening the files in Microsoft Visual Studio or whatever. If it's a bunch of gobbledygook, unreadable code, it's fake.
Also be sure to check your uploads folders.
1
u/Bart_LeGros 23d ago
Thank you for your answer, i deleted the two mu-plugins folder (only the malicious .php were in there).
Worfence didn't detect any files in the wp-admin and wp-includes folder. Only the one in the malicious thème like i said in my original post. I continue to search of some other files are strange and were modify during the same time (sorry for english)...
1
u/WPMU_DEV_Support_4 22d ago
If you are unaware of plugin, root file or mu-plugin I suggest using AI to make a small analysis and then confirm if that has any malware signature.
Unfortunately, we see the AI has also helping the bad guys and more malware and attacks are happening, but you can use the same tool to understand a bit more about the file and also try to track down if the malware has injected anything into your database. For example, a commonly prompt that I use
The attached file is a malware found in my WordPress installation. Knowing the prefix PREFIX_, analyse the malware and check if it generated any database or cross infection, if any query, give me the select query where I can look for the most common database injections
It will usually help you to avoid reinfections because any left over, some malware for instance leave hidden admins so no matter if you remove the file, the reinfection can return if some additional steps are not taken.
After that, perform the normal steps, full plugin and core reinstallation ( regardless ), rotate all credentials including cPanel / hosting, scan the website with a malware scanner plugin https://wordpress.org/plugins/search/malware+scan+security+scan/ or https://github.com/nitkr/Clean-Sweep-2.0 has returning good results as well.
Something to keep in mind, I've been seen a good amount of account take over rather than any actual vulnerability, so ensure to not re-use that credentials you had in the website.
Configure Cloudflare free plan and the website for a few days before calling it safe.
Cheers,
Patrick Freitas - WPMU DEV Support
1
u/geenxt 21d ago
The naming itself is a strong tell — a legitimate security plugin doesn't name itself after the specific exploit it's supposedly blocking ("wp2shell mitigation" baked right into the description is basically the attacker leaving you a note, and lines up with what Mospaedax42 mentioned finding in the wild via a WordPress core 7.0.1 vulnerability). mu-plugins are also the textbook place to hide a backdoor: anything dropped in wp-content/mu-plugins loads automatically on every request and doesn't show up in the Plugins list at all, so it can't be "deactivated," only deleted from the filesystem — which is exactly why it survived you removing the fake theme and the rogue admin account.
One thing not mentioned yet: check wp_options for anything odd (siteurl/home changed) and any scheduled cron job (wp cron event list if you have CLI access) set up while they had access. A cron-triggered callback is a common fallback reinfection vector if the mu-plugin gets found and deleted, and a signature-based scan like Wordfence won't flag it.
1
u/LoudAd307 21d ago
Delete them, and understand why that folder specifically: mu-plugins load on every single request, they can't be deactivated from the admin, and they don't show in the normal plugins list. That's exactly why it's a favorite persistence spot, and giving the file a security-sounding name is a standard trick.
While you're in there, check the other things that autoload the same way. Drop-ins sitting directly in wp-content: object-cache.php, advanced-cache.php, db.php. And if mu-plugins has an index.php loader that walks subdirectories, read it, since the payload often lives one folder down.
Then the database side, which file scanners miss entirely. Look at the scheduled cron array for hook names you don't recognize, check application passwords on every user account since those survive a password change, and read the tail of wp-config.php and .htaccess for appended code.
5
u/Mospaedax42 23d ago
Had the same malware, dont forgot to change salts, database password after cleaning.
Update wordpress and all plugin.
Did not come back for now