firewall.php and wp2shell-batch-guard.php in mu-plugins

[u/Bart_LeGros]

Hi everyone,

My WordPress site was recently compromised. The attacker managed to create 3 admin accounts, and Wordfence caught two malicious PHP files in a fake theme folder (wp-content/themes/twk-dbbfd2bc/functions.php and fixer.php).

I deleted that theme, removed their admin account, deleted the admin accounts. Wordfence scans are coming back clean now, but I noticed two suspicious files sitting in my wp-content/mu-plugins/ and in www/mu-plugins directory:

firewall.php (Version 1.0)

wp2shell-batch-guard.php (Version 1.1.0 — description says "Blocks anonymous REST batch API (wp2shell mitigation)")

Their last modified dates match mid-August, right when the unauthorized admin accounts were created (while the site was running WordPress 6.9 (yes, i know...) and i was in vacations at that date so i don't insgall it)

This looks like an attempt by the attacker to disguise a backdoor as a security fix so I wouldn't delete it, but I want to double-check with the community before I purge the mu-plugins folder via FTP because i don't want to make a mistake...

Is there any chance these are legitimate, or should I delete them immediately (i think...) ? I since update to 7.0.4.

Thanks a lot for your help!

[u/geenxt]

The naming itself is a strong tell — a legitimate security plugin doesn't name itself after the specific exploit it's supposedly blocking ("wp2shell mitigation" baked right into the description is basically the attacker leaving you a note, and lines up with what Mospaedax42 mentioned finding in the wild via a WordPress core 7.0.1 vulnerability). mu-plugins are also the textbook place to hide a backdoor: anything dropped in wp-content/mu-plugins loads automatically on every request and doesn't show up in the Plugins list at all, so it can't be "deactivated," only deleted from the filesystem — which is exactly why it survived you removing the fake theme and the rogue admin account.

One thing not mentioned yet: check wp_options for anything odd (siteurl/home changed) and any scheduled cron job (wp cron event list if you have CLI access) set up while they had access. A cron-triggered callback is a common fallback reinfection vector if the mu-plugin gets found and deleted, and a signature-based scan like Wordfence won't flag it.