A suspicious scheduled event is only half the incident. Removing one cron entry is temporary if a plugin, MU plugin, option or external process is still registering it again.
Inventory scheduled hooks before deleting anything
Record hook name, next run time, recurrence and callback owner. Compare the list with installed plugins and known application jobs. An unfamiliar name is not proof of malware; provenance and behaviour matter.
Separate a malicious event from an orphaned legitimate job
- Trace the callback to the file or class that registers it.
- Check when the event first appeared relative to the incident.
- Review whether the callback writes files, creates users or calls unexpected remote services.
- Look for the same hook being recreated immediately after deletion.
Preserve the schedule and writer before removal
Take a snapshot of the event and related code. If the schedule is actively causing harmful side effects, contain execution while retaining enough evidence to identify the component that created it.
Remove both the event and its registration path
- Disable or remove the confirmed malicious writer.
- Unschedule the malicious event through WordPress-aware APIs.
- Reinstall or patch affected components from trusted sources.
- Rotate credentials if the callback exposed or used privileged access.
Look for companion persistence
Scheduled callbacks often work with MU-plugin loaders or database persistence in wp_options. If either remains, the cron event can return after cleanup.
Do not disable WP-Cron globally as the cleanup
That can stop backups, scheduled publishing, WooCommerce work and legitimate maintenance while leaving the malicious registration code present.
Verification over multiple schedule cycles
The malicious hook must stay absent through normal requests and scheduled runs, legitimate jobs must still execute, and no file, option or user change associated with the old callback may reappear.
WP REPAIR INCIDENT STANDARD
Safe intervention sequence
Deleting the event can stop one cycle, but the loader that re-registers it may recreate the task on the next request.
- Export all events with hooks, recurrence, next run and arguments.
- Map each unknown hook to the PHP callback that registers or handles it.
- Compare event creation and execution times with file changes or reinfection.
- Inspect mu-plugins, active plugins, themes and database options for registration code.
What must be verified
- Suspicious hooks and registration code are removed.
- No file, user or option is recreated after cron cycles.
- Legitimate scheduled jobs continue to run once.
Official technical sources
This guide explains the diagnosis. If the site is affected now, the intervention should preserve a rollback path and verify the real business journey.
See the emergency repair service →ABOUT THIS SYMPTOM
Frequently asked questions about this guide.
If I delete the suspicious scheduled task, is that enough to stop it?+
Not necessarily. Deleting the event can stop one execution cycle, but if a hidden loader is still present and re-registering the task, it can simply recreate the same or a similar cron entry on the next request.
Is it safe to manually trigger an unknown cron hook to see what it does?+
No. Unknown hooks should not be run on production just to observe behavior, since they may send mail, rewrite files, or contact attacker-controlled infrastructure the moment they execute.
Can a malicious cron entry remain even after the plugin that created it has been removed?+
Yes. This is called database-only residue: the scheduled event can persist in the cron array even after the original registering code has been deleted, which is why the cron array itself needs to be checked, not just the list of active plugins.
What does it mean if a cron task is set to run every minute or unusually often?+
A very high execution frequency is a common pattern for tasks used to preserve unauthorized access or send spam continuously, since frequent execution keeps the attacker's foothold refreshed. Comparing the recurrence and next-run values across all events helps surface this kind of abuse quickly.