1. Anatomy of a Base64 Obfuscated Payload
Sophisticated attackers inject deeply obfuscated PHP webshells into core files (like `wp-blog-header.php` or `wp-includes/post.php`). These droppers use nested encoding chains (`eval(gzinflate(base64_decode(...)))`) to bypass static malware scanners and dynamically execute remote payloads from memory, leaving no trace in the database.
<?php
/* Core header stub */
$x = "b" . "a" . "s" . "e" . "6" . "4" . "_d" . "e" . "c" . "o" . "d" . "e";
$y = "g" . "z" . "i" . "n" . "f" . "l" . "a" . "t" . "e";
// Payload executes silently during standard WordPress initialization
@eval($y($x("SyvNzMzNVbCtzC9Kz...")));
?>2. Core Checksum Verification
Because attackers modify core files to ensure persistence across theme and plugin updates, the most reliable detection mechanism is cryptographic checksum verification. WP-CLI allows engineers to instantly compare the MD5 hashes of the live server's files against the official WordPress.org release manifest.
# Identify modified, compromised core files instantly
wp core verify-checksums
# Force reinstall core files to eradicate backdoors without touching wp-content
wp core download --skip-content --force3. Hardening the Perimeter
Once the backdoor is eradicated, strict perimeter defenses must be deployed: locking down `xmlrpc.php`, rate-limiting the WordPress REST API endpoints to authenticated users only, deploying Cloudflare Edge WAF rules, and setting immutable OS-level file permissions (`chmod 444`) on configuration files.