WordPress Security News & Updates

Stealthy PHP Malware Uses ZIP Archive to Redirect WordPress Visitors

Puja Srivastava
July 11, 2025

Last month, a customer contacted us, concerned about persistent and inexplicable redirects on their WordPress website. Our investigation quickly unearthed a sophisticated piece of malware…

Read the Post

Attackers Inject Code into WordPress Theme to Redirect Visitors

Matt Morrow
July 9, 2025

In a recent article we discussed some of the reasons sites are frequently attacked. That article covered browser redirects, and we’ll explore an example of…

Read the Post

Fake Spam Plugin Uses Victim’s Domain Name to Evade Detection

Kayleigh Martin
July 2, 2025

During our investigation of an SEO spam infection (spam content designed to manipulate search engine results), we discovered a nicely crafted plugin that named itself…

Read the Post

Sucuri Vulnerability Roundup - June 2025

Vulnerability & Patch Roundup — June 2025

Sucuri Malware Research Team
June 30, 2025

Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…

Read the Post

Stealthy WordPress Malware Drops Windows Trojan via PHP Backdoor

Puja Srivastava
June 27, 2025

Last month, we encountered a particularly interesting and complex malware case that stood out from the usual infections we see in compromised WordPress websites. At…

Read the Post

The Case of Hidden Spam Pages

Ben Martin
June 25, 2025

Spammy posts and pages being placed on WordPress websites is one of the most common infections that we come across. The reason being is that…

Read the Post

Malicious WordPress Plugin Creates Hidden Admin User Backdoor

Matt Morrow
June 20, 2025

I recently wrote about a case where a malicious plugin was used to steal admin credentials. Here we will examine yet another malicious plugin that…

Read the Post

Analysis of a Malicious WordPress Plugin: The Covert Redirector

Puja Srivastava
June 18, 2025

A few weeks ago, we received a support request from a website owner who was experiencing unexpected redirects. Visitors landed on the website normally, but…

Read the Post

Fake WordPress Caching Plugin Used to Steal Admin Credentials

Matt Morrow
June 4, 2025

A common trend we see is that bad actors will upload malicious plugins to WordPress sites. These plugins serve a wide variety of functions from…

Read the Post

Sucuri WordPress Vulnerability Roundup May 2025

Vulnerability & Patch Roundup — May 2025

Sucuri Malware Research Team
May 30, 2025

Read the Post

Fake Java Update Popup Found in Malicious WordPress Plugin

Puja Srivastava
May 27, 2025

We recently assisted a customer who reported a persistent and concerning “Java Update” pop-up appearing on their WordPress website. This type of deceptive notification is…

Read the Post