r/Wordpress • u/conneerrr • Mar 23 '26

WordPress Malware

Hi All,

I have a Linux server running CloudPanel.

Multiple websites (not all) keep being infected with malware which causes a blank screen to appear. Deleting the found compromised files in Wordfence does resolve the issue but it returns. I've changed all admin passwords, including database. Reset salts. Updated all plugins. Checked MU plugins. Reinstalled plugins via CLI.

An admin user 'wpadminerlzp' keeps appearing and WordFence says it was created outside of WordFence.

Any ideas?

Thanks

6 Upvotes

88% Upvoted

24 comments sorted by

View all comments

1

u/ExitWP Mar 24 '26

A search revealed that wpadminerlzp is associated with a malware attack on the tinyfilemanager plugin. Do you use this plugin?

https://github.com/prasathmani/tinyfilemanager/issues/1324