Wordfence uncovers WordPress malware concealed as must-use plugin

The Wordfence Threat Intelligence Team published a technical analysis on 22 September 2026 concerning WordPress malware identified in mid-June during a client site cleanup. The peculiarity: the malicious code is not a standard plugin, but a must-use plugin (mu-plugin), the category of PHP files that WordPress automatically loads from wp-content/mu-plugins/ without appearing in the backend's "Plugins" screen. For those administering shared hosting or managing dozens of WordPress installations on behalf of third parties, this detail changes operational procedures: a mu-plugin cannot be deactivated from the dashboard—it must be located directly in the filesystem.\n\n## Why mu-plugins make a convenient hiding place\n\nAccording to Wordfence's report, files in mu-plugins are executed with every request but do not appear among active or deactivable plugins in the WordPress administrator interface. This creates a blind spot for those conducting checks solely through the web interface: a visual scan of the plugin list will not detect them.\n\n## The self-healing mechanism\n\nThe post describes the sample as having "several self-healing mechanisms in place in order to survive removal". The source does not specify the implementation details of these mechanisms in the available summary; for the precise techniques (hooks used, files involved, reinfection method), we defer to the full publication on the Wordfence blog.\n\n## What to check on the hosting side\n\nFor those managing shared servers, standard operational practice remains unchanged: include wp-content/mu-plugins/ in periodic malware scans, do not rely solely on the plugin list from wp-admin, and verify write permissions on that folder, which in theory should only be populated manually by the site administrator and not by web-facing processes.\n\nSource: Wordfence Threat Intelligence Team, official blog, 22 September 2026 — https://www.wordfence.com/blog/2026/09/inside-a-malicious-stealthy-wordpress-must-use-plugin/