Attackers often abuse WordPress AJAX actions registered by malicious or vulnerable code. The core wp-admin/admin-ajax.php file is usually only the dispatcher; replacing it does not remove the malicious callback.
Symptoms
- Large numbers of suspicious POST requests hit /wp-admin/admin-ajax.php.
- Unknown AJAX actions trigger redirects, file writes or database changes.
- Security logs show admin-ajax traffic during reinfection.
- The core admin-ajax.php file is clean but malicious behavior continues.
Indicators of compromise
These indicators help investigation but should be interpreted in context. A single item does not automatically prove compromise.
How this threat persists
WordPress routes AJAX requests to callbacks registered by plugins/themes. Malicious code or a vulnerable action can use this normal endpoint as the transport layer.
Investigation and recovery
- Keep the WordPress core admin-ajax.php file intact if its checksum is valid.
- Identify the action parameter and the code that registers its callback.
- Patch/remove the vulnerable or malicious component.
- Review access logs and changes performed by the endpoint.
- Add targeted protection without blocking legitimate WooCommerce/editor AJAX traffic.
WP•FIX treats security incidents as root-cause investigations. The goal is not only to remove the visible payload, but also to identify the persistence mechanism and the access path that allowed the compromise.
Prevention after cleanup
Prevention depends on the actual entry point. Common controls include verified software sources, prompt patching of vulnerable components, credential rotation after compromise, least-privilege administrator access, clean backups, file-change monitoring and review of hosting/CDN/security logs.
FAQ
Should I block admin-ajax.php?
Usually no. WordPress and many plugins rely on it. Blocking it globally can break forms, WooCommerce, editors and frontend features.
Is admin-ajax.php itself malware?
Normally it is a legitimate WordPress core file. The malicious behavior is often in the callback code it invokes.
Why is there so much admin-ajax traffic?
Legitimate plugins also use it heavily. The action names, payloads and resulting behavior determine whether traffic is suspicious.
Can a WAF fix this alone?
A WAF can reduce exploitation, but compromised or vulnerable server-side code still needs remediation.
Seeing signs of admin-ajax.php Malware Abuse?
Send the site URL and the exact behavior you or visitors see. Include screenshots or warning text when available.
Open a security incident