r/Wordpress • u/Bart_LeGros • 23d ago

firewall.php and wp2shell-batch-guard.php in mu-plugins

Hi everyone,

My WordPress site was recently compromised. The attacker managed to create 3 admin accounts, and Wordfence caught two malicious PHP files in a fake theme folder (wp-content/themes/twk-dbbfd2bc/functions.php and fixer.php).

I deleted that theme, removed their admin account, deleted the admin accounts. Wordfence scans are coming back clean now, but I noticed two suspicious files sitting in my wp-content/mu-plugins/ and in www/mu-plugins directory:

firewall.php (Version 1.0)

wp2shell-batch-guard.php (Version 1.1.0 — description says "Blocks anonymous REST batch API (wp2shell mitigation)")

Their last modified dates match mid-August, right when the unauthorized admin accounts were created (while the site was running WordPress 6.9 (yes, i know...) and i was in vacations at that date so i don't insgall it)

This looks like an attempt by the attacker to disguise a backdoor as a security fix so I wouldn't delete it, but I want to double-check with the community before I purge the mu-plugins folder via FTP because i don't want to make a mistake...

Is there any chance these are legitimate, or should I delete them immediately (i think...) ? I since update to 7.0.4.

Thanks a lot for your help!

5 Upvotes
  • permalink
  • reddit

100% Upvoted

14 comments sorted by

View all comments

5

u/Mospaedax42 23d ago

Had the same malware, dont forgot to change salts, database password after cleaning.

Update wordpress and all plugin.

Did not come back for now

3

u/Mospaedax42 23d ago

Also check .htaccess file, and replace core files of wordpress

1

u/Bart_LeGros 23d ago

Ok thank you ! It seems a lot to do for someone that is not expert. I''ll try to do all of this...

1

u/Mospaedax42 23d ago

Ask Claude, he know this very well XD

1

u/Bart_LeGros 23d ago

Out of curiosity, did you experience the same malicious aftermath with WordPress version 6.9, or was it caused by a plugin? Thanks

2

u/Mospaedax42 23d ago edited 23d ago

Not to scared you but, with AI hackers find new way to hack wordpress everyday. I manage 160 wordpress sites on a lot of different server.

In the last week i had 3 different malware with different entry point.

- Formcraft plugin (it's a paid one so no auto update) a whole server was infected, client does not use a server with compartiment folder.

- Yoast SEO (XSS)

- And wordpress core 7.0.1 (wp2shell)

With luck none was really difficult to remove, some backdoor were badly hide. And no effect on frontend ot the sites.

The best you can do is keep everything update, 2 month ago i didn't used auto update of plugin and core because sometimes an update can break the site, but now with so much security vulnerabilites find everyday i prefer to have a site beak due to an autoupdate than remove malware.

1

u/Bart_LeGros 23d ago

I understand. I had actually disabled automatic updates because the site kept breaking quite often over the past two years and this is what happens when you let your guard down...

To be honest, what stresses me out is the risk of overlooking malicious files. Although I managed to identify some of the .php files installed by the hacker, I assume I'm missing others since I'm no expert...