How to Clean WP-VCD and Eval-Base64 Malware in WordPress

WP-VCD is a notorious malware strain often bundled with "nulled" (pirated) themes and plugins. It infects your functions.php files and creates persistent backdoors like class.wp.php.

Locating the WP-VCD Infection

The WP-VCD malware typically injects a massive block of encoded PHP at the very top of your theme's functions.php.

You can search for the common signature across all themes:

grep -rn "wp_vcd" wp-content/themes/

You will also find rogue backdoor files. The most common locations are wp-includes/wp-vcd.php and wp-includes/class.wp.php. Delete these files entirely.

Cleaning functions.php

Open your infected functions.php files and carefully delete the injected PHP code at the top. The legitimate theme code usually starts further down.

Verifying WordPress Core Checksums

Because WP-VCD modifies core files, the fastest and most secure way to ensure the core is clean is to reinstall it using WP-CLI.

First, check which files have been tampered with:

wp core verify-checksums

Then, force a clean download of the WordPress core (without affecting wp-content):

wp core download --skip-content --force

This instantly overwrites any modified core files with legitimate, cryptographically signed versions from WordPress.org.

---

Need Expert Help?

Malware recurrence is common if backdoors are missed. JagaWeb secures critical systems for nCrypt and Agros Empire. Get our RM5,000 Ownership & Access Review for a deep codebase audit, or subscribe to our RM450/month Care Plan for automated integrity checks. Contact us today.