What matters first: WP-VCD is associated with pirated component packages that add backdoors, create files and inject advertising or redirects. Cleaning the active theme alone fails when the original installer or loader remains.
What this symptom actually tells you
The infection frequently touches multiple themes and may create scheduled persistence. A clean package inventory and source history are essential.
Capture evidence before changing anything
- Identify every theme and plugin installed from unofficial or nulled sources.
- Search for known loader filenames and unexpected includes across themes.
- Inspect cron, users, uploads and recently modified PHP files.
- Preserve hashes and package archives before removal.
Most common causes
- Nulled package: The initial theme or plugin was bundled with malicious code.
- Cross-theme injection: The loader writes into every available theme.
- Cron persistence: A scheduled callback restores code after deletion.
- Credential theft: The backdoor enables later access independent of the original package.
Safe diagnostic and repair sequence
- Remove the untrusted package and replace all affected components from official sources.
- Reinstall clean themes rather than editing suspicious fragments in place.
- Delete malicious cron and files only after preserving evidence.
- Rotate credentials, invalidate sessions and audit other sites using the same packages.
How to choose between the likely causes
Do not treat Nulled package and Cross-theme injection as interchangeable. The initial theme or plugin was bundled with malicious code. By contrast, the loader writes into every available theme. Use two checks to separate them: Identify every theme and plugin installed from unofficial or nulled sources; and search for known loader filenames and unexpected includes across themes. Those observations usually show whether the next safe move is to remove the untrusted package and replace all affected components from official sources or to preserve the current state and widen the investigation.
On a compromised site, containment and cleanup are separate decisions. Preserve the suspicious artefact and access logs before removing persistence, then rotate credentials only after the active path has been closed. Record the exact timestamp, affected URL or transaction, last known good state and every change made during diagnosis. That handover is often what separates a repeatable repair from a temporary disappearance of the symptom.
What not to do
Do not search for and delete only one famous WP-VCD filename. Variants rename loaders and leave generic backdoors.
How to verify the repair
- All themes and plugins have trusted provenance.
- No cross-theme injection or malicious cron reappears.
- Outbound requests, redirects and administrator users remain normal.
A visible symptom disappearing is not enough. Close the incident only when the original failing action, the surrounding business journey and the relevant logs all agree that the fault is gone.
WP REPAIR INCIDENT STANDARD
Reconstruct the incident before fixing it
The infection frequently touches multiple themes and may create scheduled persistence. A clean package inventory and source history are essential.
- 1
Identify every theme and plugin installed from unofficial or nulled sources.
- 2
Search for known loader filenames and unexpected includes across themes.
- 3
Inspect cron, users, uploads and recently modified PHP files.
- 4
Preserve hashes and package archives before removal.
What must be verified
- All themes and plugins have trusted provenance.
- No cross-theme injection or malicious cron reappears.
- Outbound requests, redirects and administrator users remain normal.
Official technical sources
This guide explains the diagnosis. If the site is affected now, the intervention should preserve a rollback path and verify the real business journey.
See the emergency repair service →ABOUT THIS SYMPTOM
Frequently asked questions about this guide.
If I remove the one obviously infected theme, is the site clean?+
Not reliably. WP-VCD is known for touching multiple themes on the same installation and creating scheduled persistence, so cleaning only the active theme while leaving other infected themes and cron entries in place will likely lead to reinfection.
Is searching for and deleting one well-known WP-VCD filename a sufficient fix?+
No. Variants of this malware rename their loader files and can also leave behind generic backdoors that don't match any single known filename, so a search limited to one signature will miss related infections.
Why does WP-VCD infection usually trace back to a specific type of plugin or theme source?+
It's strongly associated with pirated or 'nulled' theme and plugin packages that come pre-bundled with malicious loader code. Identifying every component installed from unofficial sources is a necessary first step in tracing the infection's origin.
Should the infected theme files be edited in place to remove the malicious code?+
Reinstalling clean themes and plugins from official sources is safer than editing suspicious fragments in place, since manual edits can miss embedded backdoor code that isn't obvious on inspection.