Attackers can abuse WordPress scheduled events to recreate files, users, options or remote payloads after cleanup. A malicious cron event may look harmless until its callback or stored arguments are examined.
Symptoms
- Deleted malware reappears on a schedule.
- Unknown cron hooks exist without a matching legitimate plugin.
- Unexpected files/users/options return after wp-cron.php executes.
- The infection seems dormant and then reactivates hours later.
Indicators of compromise
These indicators help investigation but should be interpreted in context. A single item does not automatically prove compromise.
How this threat persists
The cron entry is usually one persistence layer. The callback code can live in a plugin, theme, MU plugin, database-loaded code or another backdoor.
Investigation and recovery
- Export or record suspicious scheduled events before deletion for evidence.
- Identify the callback and code path behind each unknown hook.
- Remove the malicious event and the code that recreates it.
- Review external cron jobs at the hosting level as well as WordPress WP-Cron.
- Monitor the site after cleanup across multiple cron cycles.
WP•FIX treats security incidents as root-cause investigations. The goal is not only to remove the visible payload, but also to identify the persistence mechanism and the access path that allowed the compromise.
Prevention after cleanup
Prevention depends on the actual entry point. Common controls include verified software sources, prompt patching of vulnerable components, credential rotation after compromise, least-privilege administrator access, clean backups, file-change monitoring and review of hosting/CDN/security logs.
FAQ
Is WP-Cron itself insecure?
WP-Cron is a normal WordPress feature. The risk comes from malicious code registering scheduled tasks after a compromise.
Can disabling WP-Cron stop reinfection?
It may delay one mechanism but can break legitimate scheduled tasks and does not remove the malicious code.
Should every unknown cron event be deleted?
No. Plugins often create scheduled hooks. Identify the owning component and purpose first.
Can hosting cron jobs reinfect WordPress too?
Yes. Server-level scheduled tasks are separate from WP-Cron and should be reviewed in persistent incidents.
Seeing signs of WP-Cron Backdoor?
Send the site URL and the exact behavior you or visitors see. Include screenshots or warning text when available.
Open a security incident