WP-VCD came in with a nulled theme or plugin, and it leaves only with it.

Nulled themes and plugins are paid WordPress products with their licence checks removed, redistributed free on download sites. WP-VCD has long been distributed that way: the copy works as advertised, and it carries a block of PHP — usually at the top of the theme’s functions.php, or in a plugin’s main file — that runs as soon as the item is activated.

That block writes companion files with names such as wp-vcd.php, wp-tmp.php, class.wp.php, class.theme-modules.php or class.plugin-modules.php — in wp-includes, where few owners look, and in the theme or plugin folder. It then copies its loader into the functions.php of the other themes installed on the site, so switching themes does not remove it. The companion code contacts a remote server for instructions, and is typically used to inject advertising, spam links or redirects for visitors while staying quiet for logged-in administrators. Some variants have also been reported adding administrator accounts.

The pieces restore one another. Delete wp-vcd.php and the functions.php block writes it again on the next page load; clean functions.php in the active theme and an inactive theme still carries the loader. Variants differ in file names and details, so treat the names above as examples rather than a checklist.

Figure 1 · How it gets in and stays

The nulled download is the infection. Everything else follows from activating it.

How it gets in

1. A nulled theme or pluginDownloaded free from a warez site
2. ActivatedIts functions.php runs
3. Companion files writtenIn wp-includes and the theme
4. Other themes infectedTheir functions.php too

What it then does

1. Calls homeFetches code to run
2. Injects ads or spamFor visitors, not for you
3. Restores itselfFrom any surviving copy
4. Ends only with licensed copiesEvery nulled item replaced

1. 01

   Look for the companion files by name

   Files with the names WP-VCD commonly uses, anywhere under the site:

   shell

   $ find . \( -name 'wp-vcd.php' -o -name 'wp-tmp.php' -o -name 'class.wp.php' -o -name 'class.theme-modules.php' -o -name 'class.plugin-modules.php' \) -ls 2>/dev/null

   A match is a strong indicator; no match does not clear the site, because names change between variants.

2. 02

   Find code that refers to them

   The loader names the files it writes, so the infected functions.php and plugin files can be found by those names:

   shell

   $ grep -rlE 'wp-vcd|wp-tmp|class\.theme-modules|class\.plugin-modules' wp-content wp-includes --include='*.php'

3. 03

   Read the top of every theme’s functions.php

   The injected block usually sits before the theme’s own code, in active and inactive themes alike:

   shell

   $ for f in wp-content/themes/*/functions.php; do echo "== $f"; head -n 15 "$f"; done

   Compare with a clean copy of each theme. Code above the theme’s opening comment or first function, long encoded strings, or file writes and remote requests are the finding.

4. 04

   Check WordPress core against the official checksums

   Core files that were modified, and files that should not be in wp-admin or wp-includes at all:

   WP-CLI

   $ wp core verify-checksums

   Recent WP-CLI versions also warn about files that should not exist, which catches companion files under other names.

5. 05

   List administrators and installed items

   Accounts nobody created, and every theme and plugin, active or not:

   WP-CLI

   $ wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
   $ wp theme list
   $ wp plugin list

   For each paid theme or plugin, find where it came from. Anything without a licence and a vendor download is a nulled copy until proven otherwise.

1. 01

   Preserve first

   A full copy of the files and database, plus the infected files and their timestamps. The earliest timestamp usually dates the activation of the nulled item.

2. 02

   Remove every nulled theme and plugin

   Delete them entirely — active and inactive, including old themes nobody uses. Install licensed copies from the vendors, or replace them with free alternatives from WordPress.org. A cleaned nulled copy is still a nulled copy.

3. 03

   Clean the remaining themes and plugins

   Reinstall every remaining theme and plugin from its official source rather than editing out the injected block; the loader may have reached any of them.

4. 04

   Replace WordPress core and delete the companion files

   Reinstall core from WordPress.org, then remove companion files that remain in wp-includes, uploads or elsewhere, and re-run the checksum check until it reports nothing unexpected.

5. 05

   Remove accounts and rotate access

   Delete administrator accounts nobody can vouch for and revoke application passwords, then change WordPress, hosting, SFTP and database passwords and the security keys in wp-config.php.

6. 06

   Check for what else came in

   Look for scheduled events, database injections and other backdoors added while the site was compromised. WP-VCD fetches instructions remotely, so what it was told to do on your site is not fixed in advance.

7. 07

   Verify over days

   Re-run the searches above after a few days of normal traffic, and check the site as a logged-out visitor on a phone. Any companion file that returns means a copy of the loader survived.

A paid theme or plugin from its vendor comes with the vendor’s code and the vendor’s updates. A nulled copy comes with whatever the person who removed the licence check added, and no updates — so even a copy that carried no malware on day one falls behind on every security fix the vendor ships.

On agency and client sites, nulled items often arrive through a developer or a previous provider rather than the owner. An inventory of every paid item and where its licence is held is the cheapest control there is, and it is one of the first things a security audit checks.