Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors

WordPress administrators often keep their dashboard open in the same browser they use for everyday browsing. A new attack chain shows why that habit is risky.

Researchers have documented a JavaScript loader that waits for a signed-in administrator to visit a compromised page, then uses that browser’s trusted session to install a hidden PHP backdoor on the website.

The attacker never needs the admin password, because the administrator’s own browser does the work. Recent cases point to the same pattern.

One example is an admin-triggered WordPress malware campaign that exposed more than 1.2 million websites to potential compromise.

Malware that activates only during logged-in sessions is hard to spot during routine scans, which makes it a growing concern for site owners.

Security researchers at Securonix Threat Research, Akshay Gaikwad and Aaron Beardslee, identified the malware and named the chain TRUST#GRAFT.

Their analysis shows that the JavaScript does not break the WordPress login. Instead, it checks whether the visitor is already signed in as an administrator, then reuses that session to add new code to the site. Securonix also notes that it has not confirmed how the first script reached the compromised page.

Hackers Can Abuse Logged-In WordPress Admin Sessions

The infection begins with a fake security check. The script places a full-screen frame over the page that looks like a Cloudflare “Just a moment” verification screen.

While the visitor waits, the script collects details such as screen size, graphics data, timezone, and installed plugin count. It also checks for signs of automated analysis tools.

After solving a small puzzle, the browser sends this data to a controller server, which decides whether to send the next stage. The key step follows.

The script requests the WordPress plugin upload page using the browser’s existing login cookies, then reads a WordPress security token, called a nonce, from that page.

It downloads a ZIP file named wm.zip from a staging server and uploads it through the standard plugin installation endpoint.

If the upload works, the script opens the plugins page and activates the new plugin. WordPress accepts each request because the browser is already signed in with plugin rights.

Securonix stresses that this is not a standalone login bypass. The account must already be an administrator with permission to install plugins.

Even so, the risk is serious for anyone who browses public websites while signed in to wp-admin, or who uses one browser profile for both daily browsing and site management.

Persistent PHP Backdoor Hides in Must-Use Plugins

The ZIP file contains a PHP plugin named Web Media Optimizer, version 2.1. The name suggests a harmless image or media tool, but Securonix describes it as a backdoor.

It injects remote JavaScript into public pages, turns off TLS certificate checks when it fetches its controller script, and can set an administrator login cookie for the first admin account through a hardcoded token.

The plugin also protects its own presence. On activation, it copies itself to wp-content/mu-plugins/wmedia-recovery.php.

WordPress loads every file in that folder automatically, and those files do not appear on the normal Plugins page. Similar hidden must-use plugin malware has been reported before, and it shows why removing only the visible plugin is not enough.

Site owners should also take cleanup seriously. Removing the visible plugin, the mu-plugins copy, and any leftover remote script source is necessary to stop reinfection.

Admins should also review recent WordPress self-restoring backdoor malware cases, which show how deleted files can return.

Securonix recommends using a separate browser profile for wp-admin, signing out after suspicious activity, rotating administrator credentials, limiting plugin upload rights, and watching for new PHP files in mu-plugins.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.