WP-SHELLSTORM Backdoor Compromises Thousands of WordPress Sites Found on Exposed Server
An uncovered hacker control server has brought to light a vast WordPress backdoor campaign. Thousands of sites are infected with the WP-SHELLSTORM malware, granting attackers lasting unauthorized access.
Security researchers recently discovered an exposed command-and-control server operated by cybercriminals, revealing a widespread campaign that has backdoored thousands of WordPress websites. The server contained logs and tools linked to a sophisticated malware strain dubbed WP-SHELLSTORM. This backdoor is typically injected into legitimate WordPress files, allowing attackers to remotely execute commands, steal sensitive data, modify content, or use compromised sites for further phishing and malware distribution—all without the site owner's knowledge.
WP-SHELLSTORM is often planted through vulnerable plugins, themes, or weak administrator credentials. Once installed, it creates a hidden administrator user or modifies existing files to ensure persistence, even after updates are applied. The exposed server gave security analysts an unprecedented view into the scale of the operation, showing thousands of active infections across a wide range of industries and geographies. Many of the compromised sites were small to medium businesses that may lack dedicated IT security monitoring.
For website owners, the immediate implications are severe: undetected backdoors can lead to data breaches, blacklisting by search engines, and reputational damage. Mitigation starts with a thorough security audit—checking for unknown admin accounts, scanning core files for unauthorized changes, and reviewing server logs for unusual activity. However, because backdoors like WP-SHELLSTORM are designed to evade basic checks, manual detection can be difficult. Using a reputable security plugin or a professional malware removal service is strongly advised.
Prevention is equally critical. Keeping WordPress core, themes, and plugins updated is a must, as is enforcing strong, unique passwords and two-factor authentication for all user accounts. Web application firewalls (WAFs) can block exploitation attempts, and regular off-site backups ensure quick recovery if a site is compromised. Managed WordPress hosting with built-in security layers can also drastically reduce risk—AEU Hosting, for example, includes automated malware scanning, file integrity monitoring, and a WAF, helping site owners stay protected against persistent threats like WP-SHELLSTORM without requiring manual intervention.