wp-vcd on WordPress: recognise and remove the infection

If you spotted a wp-vcd.php, wp-tmp.php or wp-feed.php file in wp-includes, or strange code at the top of your themes’ functions.php, you’re dealing with wp-vcd — one of the most widespread WordPress malwares in the world. Good news: it’s well known and it cleans up, provided you tackle the cause and not just the files.

What is wp-vcd?

wp-vcd is a self-replicating WordPress malware whose primary goal is SEO spam: it injects hidden links and content into your pages to rank third-party sites, and opens admin access along the way. It spreads almost exclusively through nulled themes and plugins — pirated premium versions handed out for free on shady sites, with the malware bundled in. The moment you install the extension, wp-vcd activates.

Its signature is persistence through replication. There isn’t one file to delete, but a cycle: files in the core that re-inject code into the themes, and code in the themes that recreates the files.

Symptoms

• wp-vcd.php, wp-tmp.php, wp-feed.php or class.wp.php files in wp-includes.
• A block of code (often a long encoded line) at the top of the functions.php of all your themes, including the ones you don’t use.
• Spam posts or links you didn’t create, sometimes visible only to Googlebot.
• An unknown admin account.
• Malicious files that reappear right after deletion.

Where wp-vcd hides

• wp-includes/wp-vcd.php, wp-tmp.php, wp-feed.php — the carrier files.
• The functions.php of every installed theme — this is the replication engine.
• Sometimes wp-includes/post.php or other core files, modified to call the payload.

How to check if you’re infected

Over SSH, at the site root:

find wp-includes -name 'wp-vcd.php' -o -name 'wp-tmp.php' -o -name 'wp-feed.php'
grep -rl "wp_vcd\|wp-vcd\|tmpcontentx" wp-content/themes/
grep -rEl "eval\(|base64_decode\(" wp-content/themes/ wp-includes/

The free WP-Detox scan remotely detects this family’s files and the code injected into themes, without you digging by hand.

Removing it properly

wp-vcd resists partial cleanups: delete the files without cleaning the themes (or vice versa) and it regenerates. The order that works:

1. Back up the current state.
2. Reinstall the WordPress core from wordpress.org: this replaces wp-includes in one go and removes wp-vcd.php/wp-tmp.php. Our guide covers how to reinstall the WordPress core.
3. Delete every nulled theme — that’s the source. Don’t “clean” it, throw it out. Replace it with a legitimate version.
4. Reinstall legitimate themes and plugins from their official sources, to purge the code injected into functions.php.
5. Delete the rogue admin account and rotate every credential and the salt keys.

How it comes back (persistence)

wp-vcd’s mechanism is circular: the code in functions.php recreates the core files, and the core files re-inject the code into the themes. Removing a single link lets the other regenerate the whole thing. And as long as the original nulled theme is present, the malware returns on the first visit. The only reliable exit is to replace the core AND all themes/plugins with clean sources, at the same time.

FAQ

How did wp-vcd get onto my site? In the vast majority of cases, through a nulled theme or plugin — a pirated paid version downloaded for free outside the official repository. The malware is bundled with the extension and activates as soon as it’s installed.

I deleted wp-vcd.php but it comes back, why? Because wp-vcd self-replicates. It injects code into the functions.php of all your themes; on every load, that code recreates wp-vcd.php and wp-tmp.php. You have to clean the themes at the same time as the files, otherwise the infection regenerates.

Can wp-vcd steal data? Its main goal is SEO spam and hidden backlinks, plus creating admin access. But any active backdoor can potentially do more, so treat the infection as a full compromise and rotate every credential.

---

At WP-Detox, we clean self-replicating infections like wp-vcd by handling the full cycle — core, themes, accounts and entry flaw. The scan is free, the cleanup takes about 30 minutes, it’s €149 excl. VAT and refunded if the site isn’t clean. For the full walkthrough, see the guide to cleaning a hacked WordPress.