WordPress Malware Investigation: Hidden Admin Access, Rogue Plugin and Persistent Login Backdoor
The ColonelServer Security & Infrastructure Team recently investigated a WordPress security incident that developed into a much broader forensic investigation.
What initially appeared to be an isolated compromised WordPress installation ultimately revealed a malicious plugin, unauthorized administrative activity, hidden authentication mechanisms, persistent database artifacts and communication with external infrastructure.
During the investigation, we subsequently identified the same or related indicators across multiple WordPress websites.
This article documents the technical findings from our investigation while intentionally withholding the identities of affected websites, informations client, credentials and active authentication material.
Executive Summary
ColonelServer identified a malicious WordPress plugin masquerading as a thumbnail-related component under the name:
Hébergement Web WordPress
À partir de 3,99 $/mois
wp-smart-thumbnails
The plugin was not simply unwanted software.
Our analysis identified functionality consistent with a persistent WordPress backdoor, including remote communication, command-related functionality, arbitrary file operations, file browsing and a hidden login-token mechanism.
More importantly, available web-server logs allowed us to reconstruct a remarkably detailed sequence surrounding the compromise.
The observed sequence included an authenticated WordPress session, creation of a WordPress user, access to user-management functionality, access to the plugin upload interface, upload of a plugin and subsequent execution of a file belonging to the rogue plugin.
This gave the ColonelServer team unusually strong forensic visibility into the attack timeline.
Serveur VPS pas cher
À partir de 2,99 $/mois
How ColonelServer Discovered the Incident
The investigation began after suspicious behavior was identified on a WordPress installation managed within our infrastructure.
Rather than immediately deleting the suspicious files, our team preserved them and began correlating:
- Web-server access logs
- Filesystem timestamps
- WordPress database records
- WordPress options
- User and usermeta records
- Plugin files
- SHA-256 hashes
- Browser network captures
- External network endpoints
- Recently modified PHP files
- Installed plugin distributions
This proved important.
Deleting the malware immediately would have removed several artifacts that later allowed us to reconstruct how the attacker maintained access.
Hébergement VPS Windows
Remote Access & Full Admin
Reconstructing the Attack Timeline
One external IP address became particularly significant during the investigation.
Server logs showed the same client interacting with authenticated WordPress administration pages shortly before the malicious plugin appeared on disk.
The activity progressed through several security-sensitive WordPress operations.
Administrative Access
The client successfully reached authenticated WordPress administration pages.
This is important because the subsequent operations were not simply anonymous probes against public WordPress endpoints.
The requests were associated with an active administrative context.
WordPress User Creation
Shortly afterward, the same client issued:
POST /wp-json/wp/v2/users
The server returned HTTP:
201 Created
UN 201 response to this endpoint indicates that WordPress accepted a user-creation request.
A second request shortly afterward returned an error, but the earlier successful request remains an important part of the reconstructed timeline.
Gestion des utilisateurs
The same session subsequently accessed:
/wp-admin/user-new.php
and submitted a request to the user creation interface.
The combination of REST API activity and WordPress user-management access was therefore treated as security-relevant evidence rather than an isolated request.
Plugin Installation Interface
Seconds later, the session accessed:
/wp-admin/plugin-install.php?tab=upload
The server then recorded:
POST /wp-admin/update.php?action=upload-plugin
The request completed successfully.
Rogue Plugin Appears on Disk
Filesystem evidence places creation of the suspicious plugin files immediately after this activity.
The malicious directory contained files including:
wp-smart-thumbnails.php
emer-run.php
includes/class-thumb-cache.php
readme.txt
The close correlation between the HTTP activity and filesystem timestamps provided a particularly useful forensic link.
Direct Access to the Backdoor Component
Shortly afterward, the server recorded a successful request to:
/wp-content/plugins/wp-smart-thumbnails/emer-run.php
This completed with HTTP 200.
À ce point, the incident could no longer reasonably be treated as a routine plugin installation.
What Was Inside wp-smart-thumbnails?
The plugin attempted to present itself as functionality related to thumbnail or media processing.
Its actual capabilities told a different story.
Our analysis found interfaces and code related to diagnostic command execution, file recovery or writing, filesystem browsing and hidden authentication.
The main plugin also contained a remote beacon URL.
One identified endpoint was:
hxxps://ia-cdn[.]com/fz/c
The domain has been intentionally defanged in this article.
Hidden WordPress Login Mechanism
One of the most significant findings was contained in emer-run.php.
The malware used WordPress options associated with identifiers including:
fz_emer_login_tokens
et:
fz_emer_done_v1
These were not ordinary WordPress configuration options.
The malware maintained authentication-related state in the WordPress database and generated special login URLs using a parameter resembling:
_wplogin
This design could provide an attacker with an alternative method of regaining access without relying exclusively on the normal username/password login workflow.
Database artifacts associated with the malware were preserved during the investigation.
ColonelServer will not publish live tokens, passwords or other reusable authentication material.
Why Persistence Matters
Removing a suspicious administrator account does not necessarily remove an attacker.
Deleting one PHP file does not necessarily remove an attacker either.
Modern WordPress compromises frequently establish multiple persistence mechanisms.
Ceux-ci peuvent inclure:
- Rogue administrator accounts
- Database options
- Authentication tokens
- Malicious plugins
- Modified core files
- Must-use plugins
- Scheduled tasks
- Backdoored legitimate plugins
- PHP files hidden inside upload directories
- External command-and-control infrastructure
The malware investigated in this incident demonstrates why incident response must go beyond simply clicking « Supprimer » on an unfamiliar plugin.
Indicateurs de compromis
The ColonelServer investigation preserved cryptographic hashes for the malicious files.
SHA-256
wp-smart-thumbnails/includes/class-thumb-cache.php
5a1c1a487d4bf94dc128bbd2daa7d26b95442da147e90f2f44ed2d28fdbc7dfe
wp-smart-thumbnails/readme.txt
350863a9f11e9600048c7d0371d1cfc6135cfaca80b9ff20009b6955ce48e26e
wp-smart-thumbnails/wp-smart-thumbnails.php
35e3ae3a3e3a884fb8f36798e5743b06d22b7bbb229bef1094aa29f7f2c9bd24
wp-smart-thumbnails/emer-run.php
ed00234ad2b67dbbc9073e8c711b18b7d39e0a5255b6159189f75cf2ed99cfb9
Additional IOC
Remote endpoint observed in the malicious code:
hxxps://ia-cdn[.]com/fz/c
WordPress option names associated with the malware:
fz_emer_login_tokens
fz_emer_done_v1
Suspicious plugin path:
wp-content/plugins/wp-smart-thumbnails/
Potential special authentication parameter:
_wplogin
Administrators who discover these exact indicators should treat the affected WordPress environment as potentially compromised rather than merely deleting the matching database record.
Multiple Websites Were Investigated
Following the initial discovery, the ColonelServer team expanded the investigation to additional WordPress installations.
The same or related indicators were found across multiple websites.
For security and privacy reasons, we are not publishing the identities of the affected domains.
The broader observation is significant because it suggests that incident responders should not automatically assume that a compromise discovered on one WordPress installation is isolated.
Where websites share administrators, management infrastructure, informations d'identification, plugins or operational workflows, other environments should also be examined.
Investigation of Installed WordPress Plugins
During the investigation, ColonelServer also audited legitimate installed plugins and their external communications.
One component that received additional scrutiny was the remote administrative content functionality included in Prime Slider.
Our examination of an independently obtained official Prime Slider Lite 4.4.5 package confirmed that the plugin itself contains a system referred to internally as « Biggopti ».
The official package contains components including:
admin/admin-biggopti.php
admin/admin-api-biggopti.php
admin/assets/js/ps-admin-api-biggopti.js
and references an external API at:
api.sigmative.io
We also confirmed that this functionality exists in the official distribution rather than being an alteration unique to the compromised server.
Important Clarification
ColonelServer has NOT established that Prime Slider caused the compromise described in this report.
We are publishing this distinction deliberately.
Finding an unusual remote communication mechanism during a forensic investigation does not prove that the mechanism was exploited.
The Prime Slider functionality is therefore being treated as a separate supply-chain and trust-model question.
ColonelServer has prepared a private technical inquiry for the vendor requesting clarification regarding the ownership of the remote API, authentication of remote responses, sanitization controls and the ability to disable remote administrative content.
Responsible security research requires distinguishing evidence from speculation.
What We Have Not Proven
Our evidence establishes the presence and operation of the malicious plugin and provides a strong timeline surrounding administrative activity and its installation.
Cependant, the investigation has not yet established with sufficient confidence how the attacker obtained the initial authenticated access.
Possible initial-access mechanisms in WordPress incidents can include stolen credentials, session theft, compromised administrator devices, vulnerable plugins, supply-chain incidents or other application vulnerabilities.
Without evidence establishing one of these mechanisms, ColonelServer will not attribute the initial compromise to a particular vendor or vulnerability.
Lessons for WordPress Administrators
This incident reinforces several important defensive principles.
Do Not Trust Plugin Names
A directory name that looks plausible does not make a plugin legitimate.
Attackers routinely select names that resemble caching, médias, Référencement, maintenance or optimization components.
Preserve Evidence Before Cleaning
When operationally possible, preserve suspicious files before deleting them.
Record:
- SHA-256 hashes
- File timestamps
- File ownership
- Relevant access logs
- Database records
- Active sessions
- Installed plugin versions
Without these artifacts, reconstructing the compromise becomes significantly more difficult.
Inspect the Database
Filesystem scanning alone is insufficient.
Attackers can maintain persistence through WordPress options, user metadata, scheduled jobs and authentication-related database records.
Review Successful Requests, Not Just Errors
Security monitoring frequently concentrates on HTTP 404, 403 et 500 responses.
In this incident, some of the most important requests returned:
200 OK
201 Created
302 Found
Successful requests can be considerably more important than blocked attacks.
Correlate HTTP Logs With Filesystem Timestamps
Neither source tells the complete story independently.
Ensemble, they can establish a sequence such as:
authenticated session → privileged action → plugin upload → filesystem creation → backdoor execution.
That correlation was one of the most valuable parts of this investigation.
Reporting the Malware
ColonelServer is sharing the malware information with relevant security organizations and vendors.
Our disclosure process includes providing appropriate technical information to threat-intelligence researchers while withholding credentials and sensitive information belonging to affected environments.
Malware samples, hashes and supporting forensic artifacts have been preserved for security researchers who require them through appropriate private channels.
ColonelServer Security Research
ColonelServer operates hosting and infrastructure services and routinely works with Linux servers, WordPress, plateformes de virtualisation, network infrastructure and security monitoring.
This investigation was performed internally by the ColonelServer Security & Infrastructure Team.
The investigation included log correlation, filesystem analysis, WordPress database analysis, malware inspection, network inspection, plugin verification and incident timeline reconstruction.
Our goal in publishing this research is straightforward:
When we encounter a security incident that can help other administrators recognize or investigate similar compromises, we believe the technical findings should be documented responsibly.
We will update this report if additional evidence materially changes our conclusions.
Disclosure Notice
The identities of affected websites have intentionally been withheld.
Authentication credentials, session cookies, hidden passwords, database credentials and reusable login tokens have also been excluded.
Domains and infrastructure directly embedded in the malware have been defanged where appropriate.
No vulnerability has been attributed to a legitimate WordPress plugin unless explicitly stated and supported by evidence.
Research Credit
Recherche, forensic analysis and incident reconstruction:
ColonelServer Security & Infrastructure Team
Original investigation conducted August 2026.
