METHODS FOR DETECTING AND REMOVING MALICIOUS CODE ON CMS PLATFORMS (A CASE STUDY OF WORDPRESS)

The article examines the problem of detecting and removing malicious code on websites built on the WordPress platform, which, due to its popularity, is one of the most frequent targets of automated attacks. Typical vectors of CMS compromise are considered: exploitation of vulnerabilities in outdated versions of the core, themes and plugins, administrator credential brute-forcing, and abuse of unprotected file-upload points. Signs of infection are systematized — web shells, fake or modified plugins, hidden SEO-spam injection (cloaking), and injections into theme files. A methodology for comprehensive audit and removal of malicious code is proposed, combining static file-system analysis, checksum comparison against the official repository, web-server log analysis, and subsequent server configuration hardening. Using a real case of restoring a compromised site as an example, the effectiveness of the proposed approach is demonstrated.