Moatline

TRUST#GRAFT: a fake Cloudflare check that installs a backdoor through your own browser

Reported on 26 October 2026, TRUST#GRAFT doesn’t break your password or two-factor login. It waits for an administrator who is already signed in, then uses that browser to upload and switch on a backdoor plugin. Here is how to check your site and how to make sure it can’t happen.

By the Moatline team at Next Nova Technologies · Published 27 October 2026 · 5 min read

Worried your site is affected?See what your visitors and Google see. Free, no sign-up, about 20 seconds.
Check my site free

Securonix named this attack TRUST#GRAFT. Nothing it does is a WordPress bug: every request is a normal WordPress action. That is why it works, and why one setting stops it.

What happens

  1. A fake check covers the page. A script on the page shows a full-screen frame dressed up as Cloudflare’s “verify you are human” screen. If you click it, it can put text on your clipboard (the trick behind “paste this command” scams), and it reads tokens the site keeps in your browser.
  2. It looks for an administrator session. If the person viewing the page is signed in to WordPress as an administrator, the script quietly opens the plugin upload page in the background and reads the security token WordPress puts there.
  3. It uploads a plugin as you. It downloads a file called wm.zip, uploads it through the normal Plugins → Add New → Upload form, and activates it. To WordPress, it looks like you did it.
  4. The backdoor settles in. The plugin calls itself Web Media Optimizer (version 2.1). It hides from the Plugins screen, adds a remote script to your pages, and copies itself to wp-content/mu-plugins/wmedia-recovery.php so it survives if the plugin folder is deleted.
  5. The attacker can sign in at will. A secret address signs anyone who knows it in as your first administrator, and another one changes the script your visitors get.

Why passwords and two-factor login don’t stop it

Strong passwords and two-factor login protect the moment you sign in. TRUST#GRAFT starts later, inside a browser that is already signed in, and only asks WordPress to do things an administrator is allowed to do. The security token WordPress adds to forms (a “nonce”) doesn’t help either, because the script reads it from the page just as your browser would.

What does stop it is making plugin uploads impossible for everyone, administrators included, until you choose to allow them.

Check your site

  1. Must-use plugins: in your host’s file manager or over SFTP, open wp-content/mu-plugins. Look for wmedia-recovery.php or any file you don’t recognise. Many sites have no mu-plugins folder at all, which is fine.
  2. Plugins folder: open wp-content/plugins directly, not just the Plugins screen, and look for Web Media Optimizer or a folder you didn’t install. Note any file called ads.php inside an unfamiliar plugin.
  3. Page source: open your home page in a private window, view the source and look for scripts loading from gerlace[.]com, vtevens[.]icu or caapman[.]me, or a full-screen frame you didn’t add.
  4. Activity: if you keep an activity log, look for a plugin uploaded and activated within seconds by the same administrator, at a time nobody was working on the site.
  5. Users: check every administrator account. Our guide to unknown admin users covers hidden ones.

The free Moatline Malware Scanner 1.3.1 and newer flags wmedia-recovery.php and the TRUST#GRAFT domains when you run a scan.

If you find it

  1. Back up the site as it is, so you can look back later.
  2. Delete wp-content/mu-plugins/wmedia-recovery.php and the Web Media Optimizer plugin folder, using the file manager or SFTP.
  3. Find the script that started it. Look in posts, widgets, the theme’s header and footer and any “custom code” or header-scripts plugin, and remove scripts you didn’t add. Our fake CAPTCHA guide lists the usual hiding places.
  4. Lock the door behind you: change every administrator password, log everyone out, and change the security keys in wp-config.php so stolen sessions stop working.
  5. If you clicked the fake check and then pasted anything into your computer’s Run box or terminal, treat your computer as infected. See what to do if you ran the command.
  6. Scan the whole site for anything else left behind. See how to scan WordPress for malware.

Stop it happening

  • Lock plugin installs. The free Moatline Malware Scanner has a Lock in the admin bar. While the site is locked, nobody can upload, install or activate new plugins, administrators included, so the upload step of TRUST#GRAFT fails. Unlock for 30 minutes when you need to install something. Automatic updates keep running.
  • Browse as a lower role. Write and edit content with an Editor account, and use the administrator account only for site settings.
  • Treat “verify you are human” pages with suspicion on your own site. If one appears there, don’t interact with it: sign out, and check the site from a private window.
  • Keep plugins updated and remove ones you don’t use, since an outdated plugin is the usual way a script gets onto a site.

Source: GBHackers on Securonix’s TRUST#GRAFT research. Related: saw a fake CAPTCHA on a website?

Other plugins are being attacked right now too. See the live list of WordPress plugins under active attack.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

I use two-factor login. Am I safe?
Not from this attack. Two-factor login protects the sign-in. TRUST#GRAFT starts after you have signed in and uses your open session, so the code is never asked for. Blocking plugin uploads is what stops it.
Is the Cloudflare check real?
No. It is a full-screen frame made to look like Cloudflare’s “verify you are human” page. Real Cloudflare checks never ask you to copy, paste or run anything.
I deleted the Web Media Optimizer plugin. Is that enough?
No. The plugin copies a file called wmedia-recovery.php into wp-content/mu-plugins. Must-use plugins run on every page and don’t appear on the Plugins screen, so delete that file too, then change passwords and log everyone out.
How does the script get onto a site in the first place?
The researchers who found it haven’t confirmed that yet. On sites we have cleaned this year, scripts like this usually arrived through an outdated plugin with a known flaw or a stolen administrator password.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →