WordPress Woes: Making Malcure Work When WP CLI Fails

Sometimes a WordPress website is so corrupt, one might assume it’s beyond repair and it may be time to wipe off the slate and start from scratch.

Hold that thought for a minute.

Here’s how to test it out. Type a simple command like this and wp-cli hangs with no output.

wp option get siteurl

Nothing… nada… zilch…

It’s time to start cleaning.

First thing is to clean up WordPress core.

You’ll need access to SSH/bash to follow this guide. If that’s not possible, your next best option is to use FTP or a file manager to delete the wp-admin and wp-includes folders and then re-upload them.

If you’re still with us, let’s prepare a workspace. Assuming you’re in the root of your WordPress installation, execute the following commands to create and enter a directory named cleanup:

mkdir cleanup
cd cleanup

Now, adapt the following command to match your installation needs:

wp core download --force --skip-content --locale=nl_NL --version=6.4.3

Next, we’ll execute what we like to call the “nuke” command. This will remove the existing WordPress core directories and replace them with clean versions. This deletes WordPress core and your site will be dead for a few microseconds. Beware, you’ve been warned!

rm -rvf ../wp-admin && rm -rvf ../wp-includes && cp -rv wp-admin ../ && wp -rv wp-includes ../ && cp -rv wp-content ../ && cp ./* ../

This nuke command will remove WordPress core and reinstate the clean WordPress core files.

Voilà! You’re almost done. This process reinstates clean WordPress core files, setting a strong foundation for further troubleshooting and malware scanning.

Let’s remove the temporary folder that we created.

cd ..
rm -rv cleanup

Written by
Principal Security Researcher, Malcure Web Security

Shiv has worked in security and infrastructure since 2002, with hands-on experience across enterprise network security, incident response, problem coordination, triage management, Windows and Linux systems provisioning, scripting automation, Nginx, ModSecurity, reverse proxies, web application firewalls, WordPress malware removal, malicious redirect cleanup, SEO spam remediation, WP-CLI workflows, vulnerability response, and website hardening. His research informs Malcure’s malware detection, cleanup, and hardening methodology.