WP-VCD is a persistence family commonly associated with untrusted or modified WordPress themes. Removing the visible advertising or redirect is not enough if a loader still copies malicious code back into theme files or schedules reinfection.
Identify the compromised theme path and every copy
Record suspicious files, modification times and hashes before replacement. Compare the active and inactive themes with trusted packages, because persistence may live in a theme that is not currently selected.
Trace the loader rather than chasing injected snippets
- Search for unexpected includes and generated PHP in theme directories.
- Check scheduled tasks and early-loading code that can recreate files.
- Review writable directories for additional payload copies.
- Audit administrator users and credentials used around the infection window.
Related persistence surfaces
If the infection writes executable code into media directories, inspect PHP found in wp-content/uploads. If root files keep changing after theme cleanup, compare index.php reinfection.
Replace affected code from a trusted source
- Preserve samples and logs.
- Remove the untrusted or compromised theme package.
- Install a clean licensed copy or a trusted replacement.
- Remove secondary loaders and scheduled persistence.
- Rotate privileged credentials and invalidate unknown sessions.
Do not keep a nulled theme as the recovered baseline
If the package itself cannot be trusted or updated securely, cleaning individual files does not create a defensible long-term state.
Verification after multiple execution cycles
Theme files must remain identical to the trusted baseline through normal traffic, cron and cache cycles, with no injected ads, redirects or regenerated payloads.
WP REPAIR INCIDENT STANDARD
Reconstruct the incident before fixing it
The infection frequently touches multiple themes and may create scheduled persistence. A clean package inventory and source history are essential.
- 1
Identify every theme and plugin installed from unofficial or nulled sources.
- 2
Search for known loader filenames and unexpected includes across themes.
- 3
Inspect cron, users, uploads and recently modified PHP files.
- 4
Preserve hashes and package archives before removal.
What must be verified
- All themes and plugins have trusted provenance.
- No cross-theme injection or malicious cron reappears.
- Outbound requests, redirects and administrator users remain normal.
Official technical sources
This guide explains the diagnosis. If the site is affected now, the intervention should preserve a rollback path and verify the real business journey.
See the emergency repair service →ABOUT THIS SYMPTOM
Frequently asked questions about this guide.
If I remove the one obviously infected theme, is the site clean?+
Not reliably. WP-VCD is known for touching multiple themes on the same installation and creating scheduled persistence, so cleaning only the active theme while leaving other infected themes and cron entries in place will likely lead to reinfection.
Is searching for and deleting one well-known WP-VCD filename a sufficient fix?+
No. Variants of this malware rename their loader files and can also leave behind generic backdoors that don't match any single known filename, so a search limited to one signature will miss related infections.
Why does WP-VCD infection usually trace back to a specific type of plugin or theme source?+
It's strongly associated with pirated or 'nulled' theme and plugin packages that come pre-bundled with malicious loader code. Identifying every component installed from unofficial sources is a necessary first step in tracing the infection's origin.
Should the infected theme files be edited in place to remove the malicious code?+
Reinstalling clean themes and plugins from official sources is safer than editing suspicious fragments in place, since manual edits can miss embedded backdoor code that isn't obvious on inspection.