By 
Cybercriminals are leveraging the WordPress Must-Use Plugins (MU-Plugins) directory to inject and execute malicious code on websites while evading detection, posing a growing threat to website security.
Security researchers at Sucuri first identified this technique in February 2025. Since then, its adoption has surged, with hackers using the directory to deploy three distinct types of malicious payloads.
A Hidden Backdoor for Malware
MU-Plugins are a special category of WordPress plugins designed to run automatically on every page load without requiring activation in the admin panel. Stored in the 'wp-content/mu-plugins/' directory, these PHP files execute seamlessly and do not appear in the standard plugins list unless specifically filtered.
While MU-Plugins serve legitimate purposes such as enforcing security policies, optimizing performance, and dynamically modifying site behavior, their ability to run undetected on every page load makes them an attractive target for cybercriminals. Threat actors exploit this directory to inject malicious scripts, steal credentials, and manipulate website content.
Three Malicious Payloads Identified
Sucuri researchers have identified three primary malware payloads being deployed in the MU-Plugins directory as part of financially motivated cyberattacks:
- redirect.php: Redirects site visitors (excluding bots and logged-in administrators) to a malicious site (updatesnow[.]net) that tricks them into downloading malware via fake browser update prompts.
- index.php: Functions as a webshell backdoor, allowing attackers to remotely execute PHP code retrieved from a GitHub repository.
- custom-js-loader.php: Injects JavaScript that replaces site images with explicit content and hijacks outbound links, leading users to malicious popups.
The webshell attack is particularly alarming, as it enables hackers to execute arbitrary commands, steal sensitive data, and launch further attacks on users. Meanwhile, the redirection and JavaScript-based payloads damage website reputation, degrade SEO rankings, and facilitate malware distribution to visitors.
Although the exact method of infection remains unclear, researchers suspect that attackers exploit vulnerabilities in outdated plugins and themes or leverage weak admin credentials to gain access.
To mitigate these threats, WordPress administrators are advised to regularly update all plugins and themes to patch known vulnerabilities. Remove or disable unused plugins and themes to reduce the attack surface.Usestrong passwords and enable multi-factor authentication (MFA) on admin accounts.Make sure to conduct routine security audits to detect unauthorized modifications in the MU-Plugins directory.
