DEV Community

MD Pabel
MD Pabel

Posted on

3 SQL Queries to Find Hidden WordPress Backdoors (When Plugins Fail)

#security #sql #tutorial #wordpress

Stop trusting the "All Green" checkmark on your security plugin.

If you manage high-value WordPress sites, you know the drill: The scanner says the site is clean, but the specialized malware is still there—hiding in the database or obfuscated in a core file.

As an agency developer managing 50+ client sites, I don't have time for a full forensic audit every morning. But I also can't afford a reinfection.

Here is the "Manual Smoke Test" I run on every suspect site. It takes 5 minutes, uses zero plugins, and catches the 90% of "Ghost Admin" hacks that automated tools miss.

⚠️ WARNING: BACKUP FIRST

Before running any raw SQL queries or terminal commands, you must take a full backup of your database.

Even a simple SELECT query is safe, but getting comfortable in phpMyAdmin or SSH without a safety net is a recipe for disaster. I recommend using WP-CLI (wp db export) or your hosting panel to grab a snapshot.

I am not responsible if you accidentally DROP TABLE instead of SELECT. Proceed with caution.

1. The "Ghost Admin" Hunter

Hackers often create a user with Administrator privileges but hide it from the WordPress Dashboard using a simple functions.php filter. The only way to see the truth is to ask the database directly.

Run this in phpMyAdmin or your terminal:

SELECT u.ID, u.user_login, u.user_email, m.meta_value 
FROM wp_users u 
JOIN wp_usermeta m ON u.ID = m.user_id 
WHERE m.meta_key = 'wp_capabilities' 
AND m.meta_value LIKE '%administrator%';
Enter fullscreen mode Exit fullscreen mode

What to look for:

  • Users with generic names like system_admin, wp_updater, or support_user.
  • Emails that don't match your client's domain.

2. The "Auto-Load" Injector

Sophisticated malware (like the "Japanese Keyword Hack" or "Credit Card Skimmers") rarely lives in files anymore. It lives in the wp_options table, set to autoload=yes so it executes on every single page load.

Use this query to find the largest, most suspicious auto-loading scripts:

SELECT option_name, LENGTH(option_value) AS option_length 
FROM wp_options 
WHERE autoload = 'yes' 
ORDER BY option_length DESC 
LIMIT 20;
Enter fullscreen mode Exit fullscreen mode

The Red Flag:

  • Look for huge options (length > 10,000) with random names like 342_sd_32 or generic names like core_updater_code.
  • If you see eval( or base64_decode inside these options, you are hacked.

3. The "Recently Modified" Core Check

I learned this workflow after analyzing a particularly nasty redirection hack. Plugins were useless because the malware was "waking up" via a cron job.

I verified this technique with MD Pabel, a manual malware removal specialist I follow for forensic tips. He pointed out that attackers almost always touch a file within the last 48 hours to establish persistence.

Don't scan everything. Just scan time. Run this in your terminal (SSH):

# Find PHP files modified in the last 2 days
find . -type f -name "*.php" -mtime -2
Enter fullscreen mode Exit fullscreen mode

If you see wp-config.php or index.php in that list and you didn't edit them, you have a breach.

Summary

Automation is great for scaling, but manual verification is required for security.

  • Trust: Your git logs.
  • Verify: Your database wp_users table.
  • Never Trust: A "Clean" scan result when your client says their site is redirecting.

What is your go-to command for finding hidden malware? Drop it in the comments below—I'm always updating my snippets library.

Top comments (0)