WP-VCD Malware: The Infection That Arrives Inside the Theme
By Glenn Lyvers · Updated · 6 min read
WP-VCD is unusual among WordPress infections in one important way: it almost never breaks in. It gets carried in, by the site owner, inside a pirated copy of a premium theme or plugin downloaded from a "free" site. The download works, the theme works, and buried in it is an installer that seeds malware across your whole site the moment you activate it. For several years running it has been the most commonly detected WordPress malware family in the world, and the reason is simple: it doesn't need to find a vulnerability, because someone on the site does the installing voluntarily.
The good news is that WP-VCD is well understood and completely removable. The bad news is that it's built specifically to survive the obvious cleanup, which is why most people who try to delete it are reinfected within the hour. Here's how it actually works, and how to take it out properly.
What WP-VCD actually is
At its core, WP-VCD is a self-replicating backdoor with a sideline in monetisation. Once active, it injects spam links into your pages, redirects some of your visitors to scam and malvertising sites, creates a hidden administrator account so its operators can get back in whenever they like, and phones home to a command server for new instructions. Everything it shows to Google and everything it shows to you are deliberately different, which is why an infected site can look perfectly normal to its owner for months.
What makes it distinctive is the replication. WP-VCD doesn't live in one file. It copies itself into core WordPress files and into every theme installed on the site — not just the active one — and each copy knows how to rebuild the others.
How it got in: the download was the attack
If you have WP-VCD, then at some point you, a developer, or a previous owner of the site installed a nulled theme or plugin. There's no shame in saying so — the sites that distribute these are polished, rank well, and look legitimate — but there's also no ambiguity. This family spreads almost exclusively through pirated software, a trade I've written about in my guide to nulled themes and fake plugins. The pirates aren't giving away a $60 theme out of generosity. The malware is the payment.
That matters for cleanup, because it tells you where patient zero is: a theme or plugin directory containing the installer, usually in a file named something like class.theme-modules.php or class.plugin-modules.php.
Where it hides
A typical WP-VCD infestation has copies in all of these places, and a successful removal has to reach all of them in one pass:
In wp-includes: the files wp-vcd.php, wp-tmp.php and wp-feed.php. None of these are real WordPress files — anything with those names is malware, full stop.
In wp-includes/post.php: a short injected line near the top of this genuine core file, which loads wp-vcd.php on every page view. This is the hook that keeps the whole thing running.
In every theme's functions.php: an injected block of obfuscated code at the top of the file, in the active theme and every inactive one. I've written a separate guide to cleaning a hacked functions.php, and with WP-VCD you'll be doing it once per theme.
The original installer: the class.theme-modules.php file inside whichever nulled theme started it all.
A hidden admin user: often with a deliberately forgettable name like 100010010. My guide to hidden administrator accounts covers how these are concealed from the users list.
Why it comes back when you delete it
Each infected functions.php checks whether wp-tmp.php and its siblings still exist, and quietly recreates them if not. Delete the files in wp-includes, and the next page view puts them back. Clean the active theme, and a copy in some theme you forgot you had — the default Twenty-something themes are favourite hiding spots precisely because nobody looks — reinstalls everything. This is the loop I describe in my guide to sites that keep getting reinfected: you're not being re-hacked from outside, you're being re-hacked from inside, by the copy you missed.
Removing it completely
Take a full backup first, even of the infected state — a safety net you can diff against beats no net at all. Then work through the whole list in a single session, ideally with the site in maintenance mode so page views aren't triggering the rebuild while you work.
Delete wp-vcd.php, wp-tmp.php and wp-feed.php from wp-includes. Replace wp-includes/post.php with a pristine copy from an official WordPress download of your exact version rather than trying to hand-edit the injected line out. Then replace every theme with a fresh copy from wordpress.org or the original commercial vendor — and delete the themes you don't use at all, which costs you nothing and removes their hiding places. The nulled theme that caused this goes in the bin permanently, not back on the shelf.
Then deal with access: remove the rogue admin account, and change every administrator password along with your hosting and database passwords, since the malware has had ample opportunity to collect them. Finish with a full malware scan to catch any secondary backdoors its operators may have added while they had the run of the place — WP-VCD is often the first thing in the door, not the last.
What it was doing while it was there
Expect some cleanup beyond the files. WP-VCD's business model is spam and redirects, so check Google's view of your site: search site:yourdomain.com and look for titles you didn't write, and check Search Console for a manual action or security issue. If visitors were being bounced to scam pages, my guide to the WordPress redirect hack covers verifying the redirects are gone from every entry point. If the infection ran for months, the SEO damage and recovery timeline guide will tell you what to expect — rankings usually recover, but not overnight.
Keeping it out
Prevention here is unusually simple, because the attack needs your cooperation: pay for your themes, or use free ones from the official wordpress.org directory, and never let anyone install software on your site from a "GPL club" or download mirror. If a developer built your site, ask them where the theme licence came from — it's a fair question, and the honest ones won't mind it.
If you'd rather hand the whole job to someone who has cleaned this exact family hundreds of times, that's what I do. My malware removal service includes finding every copy, the hidden accounts, and whatever else came in behind it — and if you're not sure WP-VCD is what you have, my free checker or a quick message will settle it.
Common questions
What is WP-VCD malware?
WP-VCD is the most widespread WordPress malware family. It spreads inside pirated ("nulled") copies of premium themes and plugins, and once activated it injects spam links, redirects visitors to scam pages, creates a hidden admin account, and copies itself into core files and every installed theme so that deleting one copy lets the others rebuild it.
Why does WP-VCD come back after I delete wp-vcd.php?
Because the file you deleted is not the infection, it is one output of it. Injected code in every theme's functions.php — including inactive themes — checks for the wp-includes files on each page view and recreates them when missing. Until you clean every theme and replace wp-includes/post.php in the same session, the malware rebuilds itself within a page load or two.
Will updating or reinstalling my theme remove WP-VCD?
Reinstalling the active theme from an official source cleans that one copy, but WP-VCD also lives in your other installed themes, in wp-includes files, and in a hook injected into wp-includes/post.php. An update to a single theme leaves the rest of the infrastructure intact, which is why the infection appears to survive updates. All themes and the affected core files must be replaced in one pass.
Does WP-VCD steal customer data or credit cards?
Its core business is spam injection and redirect fraud rather than card theft. But it installs a backdoor and a hidden administrator account, which means its operators have full access to your site and database and can add anything they like later. Treat the passwords and any data stored on the site as exposed, rotate all credentials, and scan for secondary malware after removal.
Are nulled themes ever safe to use?
No. The sites distributing pirated premium themes fund themselves by bundling malware or spam into the downloads, and WP-VCD is the best-documented example. Even a copy that scans clean today gives you software with no updates, which becomes its own security hole. A theme licence costs a fraction of one malware cleanup.