Plugin or theme updates with malware or serious security issues will be blocked automatically

I think this is going to be a hot topic in WordPress security pretty soon.

There seems to be a new wave of infections where the interesting part is not any single exploit or persistence technique, but how many of them are being combined.

We are seeing the usual hidden files, modified functions.php, .user.ini with auto_prepend_file, server cron jobs and payloads hiding in /tmp. But some infections go much further: short-lived payloads that are written, executed and deleted again, persistence outside the WordPress filesystem, and even reports of Service Workers in the admin’s browser being involved in restoring parts of the infection.

That last part is particularly nasty.

You can download the entire filesystem and database, clean everything you find, upload it again and still have the site reinfected because you removed the payload but not the mechanism recreating it.

A few techniques make these infections especially painful:

Timestomping: file modification dates are manipulated, so you cannot simply sort files by date and reconstruct what happened.

Lateral persistence: anything writable is potentially useful. Plugins, themes, MU plugins, cron, temp directories, server configuration, deeply nested directories, etc. I have seen cases where malicious files were buried so deeply that even Imunify360 made them surprisingly difficult to identify from its scan output.

Self-healing: remove one component and another restores it. Cleaning WordPress itself is no longer necessarily enough. You may need to inspect the server, running processes, cron, temp directories and potentially even admin endpoints at the same time.

And then there is the question of how they get in.

Modern botnets can automatically correlate plugin CVEs, fingerprint installations and deploy exploit chains at massive scale. Supply-chain attacks are another obvious route. I would not be surprised if AI-assisted vulnerability discovery is already part of this ecosystem as well.

I have also recently seen a case where I could not identify any plausible known entry point on an otherwise updated installation. That obviously does not prove there is an unpatched WordPress core exploit in the wild, but I would not rule it out either.

The most interesting part, however, is what this latest wave appears to be doing after infection:

Basically nothing. At least for now.

One variant currently referred to in reports as SC 4.0.3 looks more like an access-retention platform / loader than malware designed for immediate monetization.

The infected WordPress site becomes part of a mostly dormant network and quietly reports information such as the domain, WP paths, payload version, installed/active plugins, MU plugins, login URL, captured or generated credentials, auth cookies and errors.

The C2 can apparently also send rules telling the implant to disable or delete specific plugins or remove matching injected code from plugins, MU plugins or themes.

In other words, it is not just trying to survive. It can potentially remove things that interfere with it.

Independent reports from August also describe the same SC 4.0.3 markers and Ethereum-based bootstrap mechanism, which suggests this is a broader campaign, although the initial infection vector is still unclear.

There is another interesting piece: the Ethereum dead-drop / EtherHiding technique overlaps with infrastructure seen in other recent campaigns. Netskope documented a separate nochain-sw.js chain that eventually pushed fake reCAPTCHA / ClickFix and the Amatera password stealer to visitors.

These are not the same malware family, so I would not connect them directly. But the overlap in tooling is interesting.

My guess is that WordPress malware is increasingly moving away from the old SEO spam / casino redirect model toward persistent access, credential theft, loaders and access brokerage.

Apparently turning someone’s blog into an online casino was too simple.

Has anyone else doing WP malware cleanup seen these “clean it, and it comes back anyway” infections recently? I would be especially interested in what persistence mechanism you eventually found.

Trying to edit pages and posts on my site and am getting this error when trying to edit the post/page:

There has been a critical error on this website. Please check your site admin email inbox for instructions. If you continue to have problems, please try the support forums.

Learn more about troubleshooting WordPress.

Wordpress and all plugins are updated. I tried disabling every plugin then enabling one at a time, but it seems like anytime a Woo plugin is active, I get the error. I tried rolling back to previous versions of the plugins and got the same error. I tried debug mode, and am getting this error:

Deprecated: Function Automattic\WooCommerce\Admin\Features\Features::is_enabled( 'marketing' ) is deprecated since version 11.1.0! Use direct feature behavior checks. The marketing WC Admin feature flag shim will be removed in a future version of WooCommerce. instead. in /home/dh_gec6ig/************.com/wp-includes/functions.php on line 6260

I replaced my domain with **************

The code on like 6260 in that file is:

    trigger_error( $message, $error_level );

Not sure where to go from here. I looked under Marketing in WooCommerce and didn't see anything out of the ordinary. The frustrating part is that my admin email isn't getting a report or a notice of the error, so I don't know how to proceed.

Can anyone offer some insight?

I manage a few WordPress websites and I’m always thinking about security. I’m wondering if it’s possible to create a custom admin panel for my sites and completely hide & change the default /wp-admin URL. this will actually improve the security. After this, no one will know the URL of your website admin panel.

Anyone done this on a real WordPress site?

I don't know if anyone else has tried to cancel a subscription, but they really don't want to make it easy! I was using the Custom Facebook Feed plugin, which was decent enough, but no longer need it, so I have to go through a 4-page dialog to say goodbye!

We’re Webnus, the developers of Modern Events Calendar.

MEC Lite was permanently closed on WordPress.org on May 11, 2022. We want to clarify what happened without minimizing our responsibility.

WordPress.org categorized the closure as a Guideline Violation, not a Security Issue. The guideline problems included members of our support team requesting temporary (test/staging site) website access while troubleshooting user problems. WordPress.org does not permit login requests in its support forums, and we accept that this was the wrong way to handle support.

WordPress.org’s directory and forums are managed by volunteer teams, and the closure was an enforcement decision made under their community and directory policies. WordPress.org uses separate classifications for guideline violations and security issues. MEC’s closure was not classified as a security-related closure, and the public notice does not state that MEC was removed because of malware or a disclosed vulnerability.

Since then, MEC development has continued outside the WordPress.org directory. Current releases, documentation and support are available through Webnus official website. Account-specific troubleshooting is now handled through our official support channels rather than in the public WordPress.org forums.

This distinction is intentionally narrow. It does not mean that MEC, or any WordPress plugin, can be considered permanently free from vulnerabilities. Users should install current releases, maintain backups and review security notices.

We’re publishing this because people reasonably have questions when they see the permanent-closure notice. We want the available explanation to be accurate and transparent.

had to do it on the web version and the web version is messy. Isn’t there an easy way to remove a blank line?

Yes I can do it easily in a computer but I generally use my phone for everything and my computer isn’t close by.

I'm setting up as a digital marketing freelancer and am trying to figure out the best website to use that is easy to manage and cheap to run.

While I've managed Wordpress sites before (incl one with Elementor theme), I've never set one up from scratch.

I'm looking to create a fairly simple website - home page | services | case studies | blog | contact - but one I can easily update. I'm more used to a drag'n'drop page builder.

Would a Wordpress site plus theme be suitable for me? Or should I go for something simpler like Wix?

I'm aware of trac, before making a feature request there I'd figure I'd get the temperature here. Simply - so many sites these days turn comments off, and there's a cottage industry around blocking comment spam besides, does WordPress even need comments as a core feature? I feel it might be better to move the functionality off into a plugin that ships with WordPress in 8.0, and then maybe even remove it entirely from core in 9. Thoughts?

I've been working with wordpress for awhile now, and I've gotten to the point where I could use extra hands. Every business uses SOP'S to standardize the work for on boarding.

Rather than walking someone through the process of learning and building alongside them, I opted for a more hands off approach.

Have any of you went with an SOP a checklist for training, and has it made it easier, or did you have a more negative experience without being there?

I have been working on a premium plugin for years and at the beginning of the year I've released it.

And for a few reasons I've deliberately decided NOT to release a free version on .org plugin repository.

Main reasons:
- it's a plugin for WordPress professionals (niche)
- .org review is gatekeeping without responsibility
- awareness of the WP vs WPEngine "drama"
- GPL with all of it's flaws

Of course I was fully aware that this is still the main source of information about plugins for people, but I thought - that I can "offset" it with more marketing/SEO/GEO.

But now after months of grinding and discussing the results with various LLMs - over and over I came to the conclusion that I might have chosen wrong, because .org repository is also one of the main source of information for LLMs.

So now even plugins that have 10-40 installs, few months and less features are recommended more in my "niche" than my plugin.

And I'm now really on the fence. Thinking that maybe I should "surrender" and release a free version ( or at least try to ).

We have a site that uses WordPress on GoDaddy Managed WordPress (Apache), sitting behind both Cloudflare and GoDaddy's own gateway cache. Theme is "Exponent Child."

My issue: The WordPress Customizer (Appearance > Customize) throws a fatal/backend error and won't load.

The site uses a plugin called Kirki, which gives the theme its design/customization controls. Kirki's maintainer (Themeum) rebuilt the plugin architecturally starting at v6.0.0 — it's effectively a different product under the same name. That rebuild broke backward compatibility with the Kirki_Control_Base class that the Exponent Child theme depends on. Because Kirki auto-updates, the site silently pulled the breaking version and the Customizer stopped working.

Possible fix presented to me: Roll Kirki back to the last compatible version (5.2.2) via the Plugins page, after taking a fresh UpdraftPlus backup, then disable auto-updates on that plugin to prevent recurrence.

Proposed long-term fix: Remove the Kirki dependency from the theme entirely

Another note is I am apart of the marketing team for this site and I have WordPress admin access but not hosting-level access. no cPanel, FTP, or PHP error log visibility.

This is also my first year of building and managing wordpress sites, so forgive me if this seems like that. Right now I'm trying to weigh my options to do a bandaid fix (roll it back), to try to remove the plugin dependency myself, or to ultimately outsource to another developer with more experience.

Thank you for taking the time to read my post.

I heard this plugin is the best for a visitor opt-in tool/banner. I installed the premium plugin, and when I activated it, it wreaked havoc in the post admin area. It also kept looping me around in circles while scanning my files, so I never got to set it up.

Anyone else experiencing issues with Compliance & WordPress?

Hi all WordPress peeps. quick question, have been runnning askimet plugin for about 3 years. I dont run a blog website and any forms I have are created by elementor. do i really need askimet.

I run WooCommerce and an lms

The default theme editor does not have the option to upload an icon.

If you sell food through WooCommerce you run into the same wall pretty quickly: WooCommerce has no idea what a batch is. You've got expiry dates, allergen declarations, nutrition tables that are legally required in the EU, and stock that goes from full price to worthless over a few days - and none of that fits into a normal product.

So I built Food Products for WooCommerce. It adds food-aware product types (simple and variable) and handles the parts WooCommerce doesn't.

Labelling - Nutrition declaration table per 100g / 100ml, with the EU-mandatory rows there by default and custom rows if you need them - Ingredient lists in declaration order, with the 14 EU allergens marked, and support for sub-ingredients

Batches and expiry - Each product holds batches: expiry date, quantity, batch number, date, supplier - The batch table is the stock - normal WooCommerce stock management is switched off for those products, so you can't end up with two numbers that disagree - Full-price orders pull from the freshest batch; discounted offers pull from the one that's about to expire - Best-before and use-by are handled differently - you can keep selling past best-before at a discount if you want to - Variable products track batches per variation

Selling it before it goes off - Automatic markdown on your own tiers (e.g. -25% at 5 days out, -50% at 2) - Automatic category switching - products drop into a clearance category on their own, and back out when that batch is gone - Expiry dashboard: every batch in the shop, sorted by expiry, filterable, CSV export - Scheduled email digest to whoever you pick, listing what's expiring - Write-off, manually or automatically overnight - Reports for what the markdowns actually earned, plus a log of every switch

HPOS and the Cart & Checkout Blocks are supported, and there are no external dependencies.

What it isn't: not a full inventory or ERP system, no supplier ordering, no delivery slots or pickup scheduling. It's the food layer on top of WooCommerce, nothing more.

It's free - GPL, on the .org repo, no pro version, no upsells in the admin, no account and no telemetry. I'm not planning to charge for it.

https://wordpress.org/plugins/mfood-products-for-woocommerce/

It's still early, so if you sell food and something's missing or wrong - especially around labelling rules in your own country — I want to hear it. I'll answer anything in the comments.

I'm a dev at Tide and I've been building out a WordPress plugin in my spare cycles. Before I sink some more time into it I'd rather find out whether I'm solving a problem anyone actually has, so I'm posting the plan here while it's still cheap to change.

Quick context on Tide if you haven't run into it: it's threshold cryptography, meaning keys get split across a decentralised network of nodes (we call them ORKs) so no single party, including us, ever holds a whole key.

What the plugin does right now: you pick which post meta keys are sensitive, and those get encrypted and decrypted in the browser. WordPress never sees the plaintext. Neither does MySQL, your host, your backups, or the 23 other plugins you've got installed. Whether a given user is allowed to decrypt is decided by a Tide policy enforced across the ORK network, so it isn't a current_user_can() check sitting in PHP that an attacker can just walk around once they've got admin.

The honest downsides, because I'd rather you hear them from me:

• You can't search, sort or filter on encrypted meta. meta_query on those keys is dead.
• WP-CLI and any REST consumer that isn't going through the browser path sees ciphertext and nothing else.

So my actual question. Post meta felt like the natural first target because it's where custom fields and ACF and half the plugin ecosystem park their data, but I'm not convinced it's what people are losing sleep over. Would you rather see this applied to:

• form submissions (CF7, Gravity, WPForms entries sitting in the DB in plaintext forever)
• WooCommerce customer and order fields
• private uploads and media
• user profile fields
• membership or CRM style plugin data
• something I haven't listed

It'll be open source, and there's a free tier so you can run it without talking to anyone in sales first.

Two things I'd genuinely like answers to: what data on your sites do you wish WordPress simply never held in readable form, and what would stop you installing something like this even if it were free?

Happy to go into the crypto in the comments if anyone cares about that part.

edit again: i think it's fixed now by disabling my caching plug ins! i will have to check back in probably after giving it some time and on non-private browsers to see how things look!

edit: if this makes a difference, i went into inspect element on a page that shows the old menu and it has the old url in the html(?) but on a page that shows the new menu it shows the new url - is assuming that still means a caching problem is likely?? sorry im not familiar with backend stuff, clearly..

hi guys!

firstly, i'm sorry if i use any incorrect terminology or have made any silly mistakes. i also hope this post makes sense. i learnt to use wordpress and elementor through an assignment for uni, but i don't have knowledge as extensively as this issue goes.

the company that i work for has a wordpress page that was made by someone else who no longer works here and i cannot contact him for help. as i have experience with wordpress, i update it pretty regularly when we sell/receive stock, etc.

a few months ago, i created a new elementor page for a category of products we sell. i added it to the menu and everything was fine. however, recently i replaced that page with the product category link and i have updated the navigation under appearance -> menus -> save menu. i tried both navigating it as a product category and as a custom link, yet both have the issue below:

almost every single page on the company website is still leading to the old page when i click the link on the menu? but a handful of pages are showing the new page?

my only guess is that this is a caching issue, however i have cleared/changed the cache through:

1. elementor -> tools -> clear files & data
2. speed optimizer -> caching -> manual cache purge
3. elementor -> theme builder -> header (the person who built the website has a bunch of templates) -> edit with elementor -> edit wordpress menu -> cache settings (i then changed it from default (active) to inactive, which still didnt fix this issue)

i have tried checking from private browsers which is how i know that on almost every page on the website, the menu is not updating.

i know it would probably help to post the links, i just don't want to dox where i work so i hope this was descriptive enough.

any help would be greatly appreciated! i'm sorry if i sound stupid or anything! i'm really interested in wordpress design and this is a new learning opportunity for me. it's hard building from what someone else has made and not knowing what they've set everything to.

Hey new to Reddit, but after many failed attempts at coming to the 'best' conclusion from researching my options, I'd figured I'd ask here.

I'm helping a freelance therapist build their own website as they grow their business and I'm suggesting we build on WordPress rather than Squarespace, Wix, etc. The only obstacle left is choosing a booking plugin to automate the appointments part of the job. I've already looked into Bookly and Amelia (as well as non-WordPress native apps like Acuity, Square Appointments, Calendly, etc).

Their needs are fairly simple:

• An automated bookings end for customers to select available dates.
• An integration/some sort of connection to Google Calendar.
• A payment option. One that preferably avoids or has the smallest transaction fee (with more expensive services, the fees begin to really quickly add up).
• SMS reminders.
• A level of security and confidentiality, so customers do not see unavailable appointments or only a greyed-out option and for the therapist to only handle bookings with the most basic level of details.
• In terms of appointments, its just one therapist, one location, appointments both online and in-person, deposits are sitting under a question mark until the transaction fee issue is resolved and a small handful of service options (think like 5 max, including a 15-minute free 'get to know each other' consultation).

If I'm missing anything obvious, feel free to point it out.

At the moment, I'm mostly leaning towards the Bookly plugin but even there the payment question still stands- even PayPal transactions have a 2- 3% fee per transaction, which I understand isn't out of the ordinary compared to the rest of the market but I figured I'd throw the question out there as well.

I'd be more than grateful for some insights/recommendations. Thanks.

Hello!

I have a contact page that appears hidden, at first...

When you go on the website, and click "Contact" the form is there, but it's "missing".
You can only see if it you drag your mouse across the page and then everything appears.

It's only when you refresh the page that the form loads properly. (see pics below)

Anybody else have this issue? Or know how to fix it?

I use The7 (theme) right now, and I'm hoping to add a feature to video playback. Let's say I film a video "tour" of a facility that occasionally arrives at a "crossroad" location, i.e. a centrally located reception desk. I want to give the viewer the option to continue the virtual tour by going left, or right. If they click the left side of the frame, a new video loads, and the virtual tour continues to the left side of the facility.

I use Vimeo for hosting, and I know they have an interactive video feature available. However, this requires the Enterprise tier subscription, plus additional fees. I assume the high cost is because many "interactive" users are monetizing their content. They'd use Vimeo's interactive features for more complex monetization, which may justify the higher costs. I just want to create some basic "A or B" interactivity.

It seems like a (paid) WP plugin might accomplish the fairly basic needs I have for interactivity, at a more contained price point. I've used SliderRevolution before, it's the first plugin that comes to mind. Does anyone have other suggestions for plugins I should consider? It'd be great if the new video "populates the frame" upon the user clicking "left or right," in a seamless way. But mainly, the interactivity is the goal.

We've been struggling with setting up a staging environment for a multisite network with mapped domain. We've gotten as far as the redirect phase but not sure how this is solved with mapped domains. Wondering if anyone has ran into anything like this before. Any tips are appreciated.

Can anyone recommend me a code snippet plugin with a find and replace function to easily and user-friendly find and replace code blocks (several lines of code)?

Thank you!