wp-malware-remediation
Cleans and remediates PHP malware in WordPress sites on Linux servers, ensuring complete security and restoration of compromised sites.
Install this skill
Security score
The wp-malware-remediation skill was audited on Jun 10, 2026 and we found 23 security issues across 3 threat categories, including 11 critical. Review the findings below before installing.
Categories Tested
Security Issues
Eval function call - arbitrary code execution
| 187 | eval(base64_decode("...")); ← eval inyectado como primera línea |
Eval function call - arbitrary code execution
| 406 | | Base64 largo | `eval(base64_decode("aWYoaX..."))` | `OBFUSC_LARGE_BASE64_STRING` | 65 | |
Eval function call - arbitrary code execution
| 414 | | PDF spoof | `%PDF-1.0 <?php eval(...)` | `OBFUSC_PDF_HEADER_SPOOF` | 85 | |
Eval function call - arbitrary code execution
| 417 | | Eval anidado | `eval($var($var(...)))` | `EVAL_NESTED_VAR_CALL` | 85 | |
Piping content to bash shell
| 525 | | `wp_backup_db.sh` | Backup BD MySQL: autodescubre wp-config, dump+gzip, lock, logs | Bash | |
Piping content to bash shell
| 526 | | `wp_reemplaza.sh` | Restauración WP core: backup BD+core, rsync, permisos, detección versión | Bash | |
Piping content to bash shell
| 527 | | `fix_permissions.sh` | Permisos: 755/644/600/711, auto-detecta grupo (CWP/PHP-FPM vs cPanel), dry-run, verbose, por usuario, CWP/cPanel | Bash | |
Piping content to bash shell
| 528 | | `malware_scan.sh` | Triage rápido: grep firmas, PHP uploads, recientes, nombres, permisos 777 | Bash | |
Piping content to bash shell
| 529 | | `wp_security_scan.sh` | Cuarentena básica: mueve sospechosos, diff WP core, archivos recientes | Bash | |
Piping content to bash shell
| 530 | | `wp_db_scan.sh` | Escaneo BD: inyecciones wp_options, SEO spam wp_posts, admins maliciosos, transients | Bash | |
Piping content to bash shell
| 531 | | `cron_check.sh` | Detección crontabs maliciosos: wget/curl reinstalación, 16 patrones, `--fix` | Bash | |
Piping content to bash shell
| 532 | | `remediate.sh` | Orquestador pipeline: 7 fases backup→scan→db→cron→clean→restore→verify→permisos | Bash | |
Webhook reference - potential data exfiltration
| 566 | | 7 | **Notificaciones** — email/webhook cuando escaneo programado detecta malware nuevo | Medio — monitoreo periódico | 🔲 Pendiente | |
Base64 decode operation
| 3 | description: "Analizar, detectar y limpiar malware PHP en sitios WordPress alojados en servidores Linux (CWP/cPanel). Cubre el ciclo completo: triage, backup, escaneo heurístico, clasificación de hall |
Base64 decode operation
| 187 | eval(base64_decode("...")); ← eval inyectado como primera línea |
Base64 decode operation
| 406 | | Base64 largo | `eval(base64_decode("aWYoaX..."))` | `OBFUSC_LARGE_BASE64_STRING` | 65 | |
Hex-encoded characters
| 116 | - Detecta y extrae PHP embebido dentro de archivos ZIP (magic bytes `PK\x03\x04`) |
Hex-encoded characters
| 186 | @include "\x2f..."; ← include ofuscado al inicio del archivo |
Hex-encoded characters
| 396 | El scanner detecta archivos con magic bytes ZIP (`PK\x03\x04`), extrae cualquier archivo `.php` contenido y lo escanea contra todas las firmas. Agrega `CONTAINER_ZIP_EMBEDDED_PHP` (90pts). |
Hex-encoded characters
| 407 | | Hex strings | `"\x65\x76\x61\x6c"` (≥20 escapes) | `OBFUSC_HEX_STRING` | 70 | |
Hex-encoded characters
| 409 | | Comment+Char-index | `/*\x00\x01*/("ab")[0].` combo | `OBFUSC_COMMENT_FUNC` | 85 | |
Hex-encoded characters
| 413 | | GLOBALS hex | `$GLOBALS["\x00\x01"]["\x02"]()` | `OBFUSC_GLOBALS_HEX_DISPATCH` | 90 | |
Hex-encoded characters
| 427 | 2. **Hex**: `echo -e "\x65\x76\x61\x6c"` o `php -r 'echo "\x65\x76\x61\x6c";'` |