WordPress WP-VCD Malware: The Solution I Used to Fix It

Years ago one of the sites I looked after got hit by the WP-VCD malware, and Wordfence caught it by flagging a change inside a WordPress core file. WP-VCD is old but still circulating, because it rides in on nulled themes and plugins from piracy sites. Here is what it does and the solution I used to clean it out, kept practical and defensive.

How to spot it

The classic sign is a modified core file. WP-VCD prepends a loader to files like wp-includes/post.php that pulls in a hidden wp-vcd.php:

<?php if (file_exists(dirname(__FILE__) . '/wp-vcd.php')) include_once(dirname(__FILE__) . '/wp-vcd.php'); ?>

That hidden file then injects a long base64 blob into your theme's functions.php, resets the file's modified date to hide itself, and phones home to inject spam links and sometimes a rogue admin user. On shared hosting it is worse: it spreads across every WordPress install under the same directory, so one infected site contaminates its neighbours.

The cleanup that worked for me

1. Take a backup first, infected and all, so you can compare and roll back if a removal step goes wrong.
2. Remove the injected loader from the affected core files and delete the dropped wp-vcd.php and any class.wp.php it created in wp-includes.
3. Clean functions.php in your active and inactive themes, stripping the base64 block prepended to the top.
4. Run a dedicated scanner. I used Anti-Malware Security and Brute-Force Firewall (GOTMLS) to scan the whole core and theme set and remove what I missed by hand.
5. Replace core cleanly. Reinstall WordPress core from the dashboard so any altered core file is overwritten with a known-good copy.
6. Check for rogue admin users and unfamiliar scheduled tasks, then rotate all passwords and salts afterwards.

How to not get hit again

The root cause is almost always a nulled theme or plugin from a piracy site. Do not install them. Keep a firewall like Wordfence that alerts on core file changes, keep everything updated, and on shared hosting compare your directory structure against a clean copy on a schedule. For a fuller technical breakdown and file samples, this WP-VCD sample repository documents the exact files involved.

Safety is cheaper than cure. A firewall that watches core files and a rule against nulled plugins would have prevented the whole thing.

Honestly, the surest fix is to stop running an attack surface you do not need. A lot of the brochure sites I used to defend like this now run as static sites with almost nothing to hack. If you are cleaning up after a hack, or want off that treadmill for good, get in touch.