We have discovered a case of malware (redirect code) being written to the WPCode – Insert Headers and Footers plugin in WordPress.


WPCode – Insert Headers and Footers Malware using the insert-headers-and-footers plugin to redirect sites to unauthorized pages

This malware installs the WPCode – Insert Headers and Footers plugin on its own, or by writing malicious PHP code to the already installed plugin, it redirects the site to another sweepstakes site or robot-authenticated redirects the site to another sweepstakes site or robot-authenticated site. In many cases, the redirection is to web-hosts.io.

In addition to the malicious redirects, the malware is clever in the following ways

The malicious PHP code added to the plugin includes code that hides the plugin’s administration screen and menu itself.
→Malformed codes are often present in the VALUE of wpcode_snippets in the wp_option table
→Because of this, the plugin’s administration screen is invisible

Users who have once logged in as administrator are not redirected.
→This makes it impossible to reproduce the redirect and delays investigation and exposure

WPCode Plugin Malware Detection and Removal

If you are experiencing symptoms of redirects on your WordPress site, you should also suspect this type of infection.
If the WPCode – Insert Headers and Footers plugin is in your plugins list or in the wp-content/plugins/insert-headers-and-footers folder, and you do not remember putting it there, you can stop and remove it. If you find the plugin in the plugin list screen or in the wp-content/plugins/insert-headers-and-footers folder and do not remember putting it in, you can stop it from executing malicious code.

Also, the fact that the hacker was able to introduce this malware means that he was able to log in to the admin panel.
We will investigate and exterminate rogue users of WordPress and search and exterminate other malware.

[Free] WordPress:Malware Scan & Security Plugin [Malware and Virus Detection and Removal].

After that, basic security measures should also be taken to prevent re-infection.

Five free WordPress security measures

Related Posts:

  1. A case of malware embedding where WordPress sends you to another site without your permission for robot verification.
    There has been a recent increase in cases of redirect hacks where WordPress sites are redirected to another site for robot verification without permission. Here are some examples of this malware embedding and how to deal with it....
  2. Be careful if your WordPress theme or plugin contains class.plugin-modules.php!
    We are seeing an increasing number of cases where WordPress themes and plugins that are available for free have a malware called class.plugin-modules.php embedded in them....
  3. If WordPress may be infected with malware (virus or tampering), use the plugin for quick malware inspection and removal.
    When WordPress may be infected with malware (virus or tampering), you can easily use a plugin to inspect and remove malware. The following is a list of the main types of malware behavior on websites and malware scanning and disinfection plug-ins....
  4. The case of Display Widgets, a plugin with malware, and how to handle the suspension of its public release
    Display Widgets is a well-known plugin used by over 200,000 sites, but it has recently been removed from the official plugin directory because it was deemed to contain malware. In this issue, we will explain the problem and how to deal with it....
  5. Case of tampering and embedding of ois.is/images/logo.png loading scripts in multiple WordPress files
    We will introduce an example of a type of malware in which an image file of ois.is is illegally embedded, which has been increasing greatly in recent years....
  6. Unauthorized installation of a plugin that can execute PHP code in WordPress.
    A new type of malware has been reported that illegally installs a plugin that can execute PHP code in WordPress and embeds malware in the database....