Skip to content
MP MD Pabel WordPress security

WordPress Malware Research Entry

wp-perf-analytics Plugin Deployer Embedded in functions.php

An unknown wp-perf-analytics plugin keeps appearing on WordPress? See functions.php code that deployed the plugin and removed its own installer block.

Reviewed: July 22, 2026
Artifact class Theme-based fake-plugin deployer
Evidence confidence High
Risk assessment Critical

Start with the problem you are seeing

Could this match the problem on your WordPress site?

This research is relevant when an unfamiliar wp-perf-analytics plugin appears and the obvious installer code is hard to find afterward. The supplied theme code wrote the plugin and then removed the marked deployment block from functions.php.

Observed in this investigation

  • The supplied functions.php block decoded and wrote a wp-perf-analytics plugin before removing its marked installer section.

Possible warning signs

  • The unfamiliar plugin can appear even when no administrator remembers installing it.
  • A later theme-file review may miss the original deployment block because the code attempted to remove itself.

These signs are investigation leads, not proof of this artifact by themselves.

Questions this research can help answer

  • Why did a wp-perf-analytics plugin appear without being installed?
  • Can infected functions.php code deploy a plugin and then erase its installer?

Evidence boundary: The deployment path is present in the supplied code; the initial source of the functions.php modification is unknown.

Seeing one of these signs on your site?

I can investigate the files, database records, users, and server evidence, explain what is confirmed, and help plan a safe cleanup.

Ask me to investigate your site See how my malware cleanup works

Research focus: Forensic analysis of a self-cleaning functions.php block that staged an encoded wp-perf-analytics plugin under wp-content.

Summary

This WordPress malware research entry documents theme-based fake-plugin deployer evidence observed during one anonymized client investigation. The narrow topic is wp-perf-analytics Plugin Deployer Embedded in functions.php: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The block operates as an installer intended to leave the wp-perf-analytics component behind after the visible theme injection removes itself. This page focuses on deployment; the related credential-logging behavior is documented separately.

Investigation context

Anonymized investigation with two code screenshots and a retained representative functions.php sample. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

functions.php contained a self-cleaning wp-perf-analytics deployer.

PHP editor showing the plugin_deployer block and wp-perf-analytics slug in functions.php
The visible block identifies wp-perf-analytics, a .plugin_deployer flag, self-cleaning logic, and an encoded payload. Only the structural evidence is reproduced publicly.

Confirmed findings

  • The block is marked plugin_deployer and runs on init.
  • The slug is set to wp-perf-analytics and the target path is under WP_CONTENT_DIR/plugins.
  • A .plugin_deployer_ flag is written under wp-content.
  • The code contains regex-based removal of its own marked block and opcode invalidation.

Technical analysis

How the deployer stages and then hides its installer

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

/* __plugin_deployer__ */
$slug = 'wp-perf-analytics';
$dir = WP_CONTENT_DIR . '/plugins/' . $slug;
$flag = WP_CONTENT_DIR . '/.plugin_deployer_' . md5(__FILE__);
// encoded plugin body and self-rewrite details redacted

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The block operates as an installer intended to leave the wp-perf-analytics component behind after the visible theme injection removes itself. This page focuses on deployment; the related credential-logging behavior is documented separately.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

  • __plugin_deployer__
  • wp-perf-analytics
  • .plugin_deployer_
  • Self-removal markers plus opcode invalidation

Contextual indicators

  • functions.php
  • init hook
  • base64_decode()
  • WP_CONTENT_DIR/plugins

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

  • The complete dropped plugin body is not published.
  • The evidence does not establish how functions.php was first modified.
  • No vulnerable theme or plugin version was identified.
  • The retained screenshots do not prove every deployment attempt succeeded.

Artifact-specific remediation

  • Preserve the infected theme file, flag, and dropped directory.
  • Replace the full theme with a trusted copy and remove the untrusted plugin directory.
  • Search wp-content for deployer markers and flag files.
  • Rotate credentials because the related investigation also retained credential-logging evidence.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

  • Confirm the plugin directory and flag do not return.
  • Monitor functions.php for the marked block after traffic and logins.
  • Compare plugin state and filesystem inventory over time.

Browse the WordPress malware research hub.

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.