WordPress glossary
mu-plugin Malware
Malicious code dropped into wp-content/mu-plugins/ so WordPress auto-loads it on every request without showing it in the plugins screen.
Last updated ยท Reviewed by Ali Yasin Jatoi
Must-use plugins (mu-plugins) load before everything else and never appear in the standard Plugins UI. Attackers exploit this to keep a persistence loader (admin user re-creator, redirect injector, C2 beacon) running invisibly. Cleanup means auditing every file in wp-content/mu-plugins/ against a known-good list and removing anything you did not install yourself.
Where this applies on our service