Threat actors are using the “mu-plugins” directory in WordPress sites to conceal malicious code with the goal of maintaining persistent remote access and redirecting site visitors to bogus sites.mu-plugins, short for must-use plugins, refers to plugins in a special directory (“wp-content/mu-plugins”) that are automatically executed by WordPress without the need to enable them explicitly via the
First seen on thehackernews.com
Jump to article: thehackernews.com/2025/03/hackers-exploit-wordpress-mu-plugins-to.html
