Understanding Scan Results

Understanding Scan Results

Finding Severity Levels

Level	Meaning	Action Required
CRITICAL	Active backdoor, self-healing malware, or admin compromise	Immediate cleanup
HIGH	Injected files, hidden plugins, webshells	Cleanup within hours
MEDIUM	Suspicious patterns, unknown plugins	Review and investigate
LOW / Info	Outdated software, weak permissions	Schedule maintenance

Core File Findings

"File should not exist"

A file exists in WordPress core directories that isn't part of the official distribution. This is almost always an injected backdoor.

Example:

wp-includes/class-wp-backdoor.php (should not exist)

Action: Delete with wp_clean_core_injections("site-name") or quarantine with wp_quarantine_file().

"File has been modified"

A core file's checksum doesn't match the official WordPress release. Could be malware injection into a legitimate file.

Action: Reinstall core with wp_reinstall_core("site-name") - this replaces all core files with clean copies.

Hidden Plugin Findings

Self-Hiding Plugin

A plugin exists on disk but doesn't appear in wp plugin list. It's filtering itself out of the admin Plugins page.

Risk flags:

• SELF-HIDING - Uses all_plugins hook to hide from Plugins list
• USER-HIDING - Uses pre_user_query to hide backdoor admin users
• SELF-HEALING - Creates/recreates admin users on every page load
• PASSWORD-RESET - Can reset other admins' passwords

Action: Delete the plugin directory first (before cleaning users), because self-healing malware will recreate users instantly.

Theme Findings

Timestamp-Named Theme

Theme directory names like config-1769998530 or custom-1770123456 are malware. Attackers install copies of legitimate themes with timestamp-based names and inject webshells inside.

Theme Contains wp-config.php

A wp-config.php file inside a theme directory is a backdoor that provides database credentials to attackers.

Theme Contains Webshell Signatures

Files with obfuscated code patterns (base64_decode, file_put_contents, dynamic code execution) inside a theme are webshell backdoors.

Action: Delete suspicious themes with rm -rf via SSH, then reinstall legitimate themes.

MU-Plugin Findings

User-Hiding Filters

MU-plugins that hook into users_list_table_query_args, pre_user_query, or pre_get_users are hiding admin users from the WordPress dashboard.

Common disguises: Files named after legitimate plugins - jetpack-performance.php, wordfence-scan-utilities.php, yoast-seo-extensions.php.

Action: Remove with wp_remove_mu_plugin("site-name", "filename.php").

Admin User Findings

Recently Created Admin

An administrator account created in the last 7-30 days during a known infection window.

Typosquatted Username/Email

Usernames like admlnlx (note: lowercase L instead of i) or emails at disposable domains.

Application Passwords Present

WordPress application passwords allow REST API access without the main password. Attackers use these as persistent backdoors named auto-bootstrap.

Action: wp_revoke_app_passwords("site-name") to revoke all, then wp_delete_user() for fake accounts.

Database Findings

Malware DB Options

Options like _pre_user_id, theme_aluma_times, theme_dc_aluma_tools are campaign markers used by malware to track infection state.

Action: wp_delete_malware_options("site-name") - remove all known markers.

False Positives

Some findings are expected and safe:

Finding	Why It's a False Positive
BuddyBoss .htaccess in uploads (bb_videos, bb_medias)	Legitimate BuddyBoss media protection
bbpress or wbcomteam plugin names flagged	Legitimate plugins matching suspicious name regex
Base64 in image-handling plugins	Legitimate encoding for image data
Minified JavaScript files	Legitimate build output

When in doubt, use wp_read_file("site-name", "/path/to/file") to inspect the file contents before taking action.