Blog
Notes from cleaning up infected WordPress sites — what gets injected, why the obvious fix fails, and how we keep cleanups precise enough that the site has no downtime afterwards.
WordPress 7.0.4 patches an author-level Imagick RCE that smuggles its payload inside a PNG, and five plugin criticals land on NVD — most of them pre-auth.
A supply-chain compromise in the BdThemes plugin ecosystem is pushing malicious payloads through a poisoned update API response, reaching sites that never installed anything new.
WordPress 7.0.3 fixes a pre-authentication reflected XSS on the login screen. A hardcoded backdoor shipped in one Advanced Responsive Video Embedder release, and The Events Calendar patched an author-level file read.
Segurium is live on the official WordPress.org plugin directory: malware detection, precise cleanup, and hardening for WordPress. Free to install — search for Segurium under Plugins → Add New. Requires WordPress 6.2+ and PHP 7.4+.
Historical note: early Segurium builds were hosted on segurium.com while the WordPress.org review was in progress. The plugin is now live in the official directory — install it from wordpress.org/plugins/segurium.
We are opening a small tester program for Segurium. 100 WordPress admins get a 1-year Pro license in exchange for real-world feedback from staging or low-risk production sites.
How Segurium restores tampered WordPress core, plugin, and theme files to canonical upstream content — and why most cleanups don't have to be wipe-and-pray.
