WP-VCD is a persistent WordPress malware infection commonly linked to nulled or pirated themes and plugins.

Unlike a simple one-file infection, WP-VCD often spreads across theme files, adds backdoors, creates unauthorized admin users, modifies WordPress core files, and reinfects the site after partial cleanup. On shared hosting, it may also affect multiple websites under the same hosting account.

This guide explains what WP-VCD malware is, how to recognize it, where it usually hides, how to clean it safely, and how to reduce the chance of reinfection.

What Is WP-VCD Malware?

WP-VCD is a WordPress malware family most often distributed through nulled themes and plugins. A site owner downloads what looks like a free premium theme or plugin, installs it, and unknowingly installs the malware with it.

Security researchers have documented WP-VCD as a long-running campaign. Patchstack reports that WP-VCD has existed for many years and mainly spreads by injecting itself into legitimate plugins and themes distributed through nulled WordPress software sites. Wordfence also describes WP-VCD as malware that hides in nulled or pirated plugins and themes and monetizes infected sites through malvertising scripts, popups, redirects, and SEO manipulation.

Once active, WP-VCD may:

  • Add malicious code to theme functions.php files
  • Create hidden or unauthorized administrator users
  • Modify WordPress core files
  • Add backdoor files such as wp-vcd.php or similar names
  • Inject spam links, ads, redirects, or SEO spam
  • Reinfect cleaned files if the original source remains
  • Spread to other WordPress sites under the same hosting account

The most important thing to understand: WP-VCD usually keeps coming back until the infected nulled theme/plugin and all persistence files are removed.

How WP-VCD Infects WordPress

The most common entry point is a nulled or pirated premium theme/plugin.

The infection often starts like this:

  1. The site owner downloads a “free” premium theme or plugin from an untrusted website.
  2. The package already contains hidden malicious code.
  3. After installation, the malware injects itself into active theme files.
  4. It creates backdoor files and may modify WordPress core files.
  5. It may create an unauthorized admin account.
  6. It may connect to attacker-controlled infrastructure to receive instructions.
  7. It reinfects cleaned files if the source file or backdoor remains.

WP-VCD can also appear alongside other security issues, such as outdated plugins, unsafe file permissions, weak admin credentials, or poorly isolated hosting accounts. But nulled software is the classic source.

Signs of a WP-VCD Infection

WP-VCD does not always show obvious symptoms immediately. The website may look normal while the malware works in the background.

Common signs include:

  • Unknown administrator users
  • Numeric usernames or suspicious admin emails
  • Theme functions.php files modified unexpectedly
  • Files named wp-vcd.php, wp-tmp.php, wp-feed.php, or similar
  • Unexpected code added to WordPress core files
  • Redirects to unknown websites
  • Popups, ads, or browser warnings
  • SEO spam in Google Search results
  • Japanese keyword spam or pharma spam
  • High CPU/resource usage
  • Malware reappearing after cleanup
  • Multiple sites on the same hosting account infected

If malware returns shortly after you remove it, assume there is still a backdoor, infected theme/plugin, cron job, or compromised account active somewhere.

Common WP-VCD File Locations and Indicators

WP-VCD infections vary, but these are common places to check:


wp-content/themes/active-theme/functions.php
wp-content/themes/other-theme/functions.php
wp-includes/wp-vcd.php
wp-includes/wp-tmp.php
wp-includes/wp-feed.php
wp-includes/wp-cd.php
wp-includes/post.php
wp-includes/class.wp.php
wp-content/plugins/unknown-plugin/
class.plugin-modules.php

You may also see suspicious code injected near the top of theme functions.php files or unexpected include statements added to WordPress core files.

Instead of publishing full executable malware samples, it is safer to look for patterns like:


wp_temp_setup
WP_V_CD
wp-vcd.php
wp-tmp.php
wp-feed.php
class.plugin-modules.php
unknown remote URL fetches
unexpected admin-user creation logic
encoded or obfuscated PHP added to theme files
unexpected includes added to core files

These indicators should be reviewed carefully. Some file names may vary between campaigns, so do not rely only on exact matches.

1. Check for Unauthorized Admin Users

WP-VCD is known for creating unauthorized administrator users in some infections.

Start by checking Users → All Users in WordPress.

Look for:

  • Admin users you do not recognize
  • Numeric usernames
  • Suspicious email addresses
  • Recently created accounts
  • Users whose role was unexpectedly changed to Administrator

If you are comfortable checking the database, review the wp_users table and administrator capabilities in wp_usermeta. Remove unknown users only after confirming they are not legitimate.

After cleanup, reset all administrator passwords and enable 2FA.

2. Check Theme functions.php Files

WP-VCD often injects code into theme functions.php files.

Check every installed theme, not only the active one:


wp-content/themes/theme-name/functions.php

Look near the top and bottom of the file for unfamiliar PHP code, obfuscated blocks, remote fetch logic, or WP-VCD-related markers.

If you are using a legitimate theme from a trusted vendor, the safest approach is usually to replace the theme files with a clean copy from the original source rather than manually editing suspicious code.

If the theme came from a nulled source, remove it completely and replace it with a legitimate version.

3. Check WordPress Core Files

WP-VCD may modify WordPress core files or add malicious include statements.

Common files to review include:

  • wp-includes/post.php
  • wp-includes/class.wp.php
  • wp-includes/wp-vcd.php
  • wp-includes/wp-tmp.php
  • wp-includes/wp-feed.php
  • index.php
  • wp-load.php
  • wp-settings.php

For core files, do not try to repair everything manually. Replace WordPress core with a fresh copy from WordPress.org while preserving wp-config.php and wp-content.

4. Find and Remove the Infected Plugin or Theme Source

This is the step many cleanups miss.

If the original nulled theme or plugin remains installed, WP-VCD can come back.

Check for:

  • Premium plugins or themes installed without a valid license
  • Software downloaded from unofficial websites
  • Unknown plugin folders
  • Files named class.plugin-modules.php
  • Plugins or themes that do not match official vendor packages
  • Recently uploaded ZIP files in public folders

Remove nulled software entirely. Do not just deactivate it. Replace it with a legitimate copy from the original developer, WordPress.org, or another trusted source.

5. Check Other Sites on the Same Hosting Account

On shared hosting or cPanel accounts, one infected WordPress site can sometimes affect other sites under the same account if file permissions and account isolation are weak.

Check every domain and subdomain under the same hosting account.

Look for the same indicators:

  • Modified theme functions.php files
  • wp-vcd.php or similar files
  • Unknown admin users
  • Injected redirects
  • SEO spam
  • Unexpected recently modified files

If multiple sites are infected, cleaning only one site will not be enough.

6. Check Public Symptoms: Redirects, Spam, and Blacklist Status

WP-VCD may cause visible public symptoms such as redirects, ads, popups, SEO spam, or blacklist warnings.

Check your site while logged out, from a mobile device, and from Google Search results.

You can also run the Securewp Remote Security Scanner to check the public-facing site for visible malware indicators, suspicious redirects, SEO spam, blacklist status, and exposed files.

A remote scanner cannot inspect every private file on your server, but it is useful for checking what visitors and search engines may see.

How to Clean WP-VCD Malware from WordPress

Follow a careful cleanup order. WP-VCD is persistent, so deleting only the obvious malicious file is usually not enough.

1. Take a backup of the infected site

Before removing files, take a full backup of the files and database. Store it safely for investigation. Do not restore it later unless you are sure it is clean.

2. Put the site in maintenance mode if visitors are at risk

If the site is showing harmful redirects, defacement, or spam, temporarily limit public access while you clean it.

3. Remove nulled themes and plugins

Delete the suspected source completely. This is usually the most important step.

Do not keep deactivated nulled software on the server.

4. Replace WordPress core files

Download a fresh WordPress package from WordPress.org.

Replace core files and folders such as:

  • wp-admin/
  • wp-includes/
  • Root WordPress core files

Do not overwrite wp-config.php or wp-content without reviewing them carefully.

5. Replace infected themes and plugins with clean copies

For legitimate software, download clean copies from the official developer or WordPress.org.

For nulled software, remove it and replace it with a legitimate alternative.

6. Clean theme files

Check all installed theme functions.php files. WP-VCD often injects code into multiple themes, including inactive ones.

If you do not need inactive themes, delete them. Keep only the active theme, child theme if used, and one default WordPress theme for fallback.

7. Remove backdoor files

Search for WP-VCD-related files and suspicious PHP files across the account.

Common indicators include:


wp-vcd.php
wp-tmp.php
wp-feed.php
wp-cd.php
class.plugin-modules.php
unknown PHP files in uploads
unexpected PHP files in cache or temporary folders

8. Remove unauthorized admin users

Delete unknown administrator accounts and review existing user roles.

Then reset passwords for all legitimate administrators.

9. Reset credentials

Reset credentials for:

  • WordPress administrators
  • Hosting control panel
  • SFTP/FTP accounts
  • Database users
  • Cloudflare or DNS accounts
  • Email accounts used for password resets

10. Check database content

WP-VCD-style infections can be accompanied by SEO spam, injected links, malicious options, or unknown admin records.

Review:

  • wp_users
  • wp_usermeta
  • wp_options
  • wp_posts
  • Widgets and custom HTML blocks
  • Page builder content

11. Scan again after cleanup

After cleaning, scan again.

Use an inside-WordPress scanner such as SiteFort to check for malware, backdoors, web shells, modified core files, vulnerable plugins/themes, suspicious redirects, and exposed sensitive files.

Then run an external scan to confirm the public-facing site no longer shows redirects, spam, or blacklist warnings.

Why WP-VCD Comes Back After Cleanup

WP-VCD often returns because the cleanup missed the source or a persistence layer.

Common reasons include:

  • The nulled theme/plugin was only deactivated, not deleted
  • Inactive themes still contain infected functions.php files
  • A backdoor file remains in wp-includes, uploads, or another writable path
  • An unauthorized admin user still exists
  • FTP/SFTP or hosting credentials are still compromised
  • Another site under the same hosting account is still infected
  • Core files were cleaned manually but not replaced with fresh copies
  • Database spam or malicious options were not removed

If the infection returns, do not repeat the same partial cleanup. Recheck every persistence layer.

How to Prevent WP-VCD Reinfection

The best prevention is simple: do not use nulled WordPress themes or plugins.

Also follow these steps:

  • Install themes and plugins only from trusted sources.
  • Keep WordPress core, plugins, and themes updated.
  • Remove unused themes and plugins.
  • Use strong, unique passwords for every account.
  • Enable 2FA for administrators.
  • Disable file editing in the WordPress dashboard.
  • Block PHP execution in uploads where possible.
  • Protect wp-config.php, backup files, logs, and Git directories.
  • Use proper file permissions and account isolation.
  • Keep clean off-site backups.
  • Monitor file changes and security logs.
  • Scan for malware regularly.

SiteFort can help with malware scanning, vulnerability alerts, hardening, firewall rules, login security, 2FA, audit logs, and Cloudflare Sync. It is not a substitute for removing nulled software, but it can help detect suspicious changes and reduce reinfection risk after cleanup.

When to Get Professional Help

WP-VCD can be difficult to clean if it has spread across multiple themes, core files, database entries, or sites under the same hosting account.

Consider professional cleanup if:

  • The infection returns after cleanup
  • Multiple sites on the same hosting account are infected
  • You cannot identify the nulled source
  • Unknown admin users keep appearing
  • Google shows SEO spam or security warnings
  • Your host suspended the account
  • The site is business-critical

If you need help, a WordPress malware removal service can clean the infection, remove backdoors, replace compromised files, and harden the site against reinfection.

Final Thoughts

WP-VCD is not just a random infected file. It is a persistent WordPress malware infection usually tied to nulled themes or plugins.

If you remove only the obvious malicious file, the infection may come back. A proper cleanup means removing the nulled source, replacing WordPress core, checking all theme files, removing backdoors, deleting unauthorized admin users, resetting credentials, checking other sites on the same hosting account, and scanning again afterward.

Most importantly, avoid nulled software completely. The “free” plugin or theme often costs far more than the original license once malware cleanup, downtime, SEO damage, and lost trust are involved.