WordPress SC backdoor uses files, database, and shared memory to rebuild itself after cleanup, hide admin access, and persist via a hidden account. Active abuse targets wpForo flaw CVE-2026-1581. #WordPress #wpForo #CVE20261581
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, And Shared Memory
Researchers uncovered a WordPress compromise where the SC backdoor uses multiple persistence layers across files, the database, shared memory, and plugins to keep restoring itself after removal. The campaign also uses Ethereum blockchain-based command-and-control, while active exploitation has been seen against the wpForo Forum WordPress plugin flaw CVE-2026-1581. #SC #wpForo #CVE-2026-1581...
www.hendryadrian.com
October 2, 2026 at 3:15 AM
WordPress SC backdoor uses files, database, and shared memory to rebuild itself after cleanup, hide admin access, and persist via a hidden account. Active abuse targets wpForo flaw CVE-2026-1581. #WordPress #wpForo #CVE20261581