Mark RauterkusTips

Thrive Incident Report

2026-05-18 · Status: publish · Development, Software, Thrive Themes

May 17, 18:05

Hello Thrive Themes Support Team,

I am reporting a major malware and compromise incident affecting multiple WordPress sites on our hosting account, including SwimISCA.org and Read.SwimISCA.org.

During the cleanup and forensic process, Wordfence repeatedly identified malicious payloads and hidden PHP backdoor files located within Thrive Theme directories and subdirectories. Examples included hidden “.storage” directories and suspicious PHP payload files inside Thrive-related paths, including:

/wp-content/themes/thrive-theme/thrive-dashboard/inc/smart-site/views/admin/templates/global-fields/modals/.storage/

Files detected included:

  • de.php
  • big.php
  • 12.php
  • hidden index.php payloads

The malware involved:

  • remote payload fetching,
  • obfuscated PHP execution,
  • eval-based execution chains,
  • Googlebot-targeted SEO spam behavior,
  • hidden persistence files,
  • and remote-control style backdoors.

We also discovered compromised WordPress core files, injected code in wp-includes files, suspicious sitemap manipulation, unauthorized Google Search Console ownership entries, and malware hidden in plugin and uploads directories.

Recovery actions included:

  • disabling all plugins,
  • replacing wp-admin and wp-includes with clean core copies,
  • switching temporarily to a default WordPress theme,
  • isolating Thrive Theme directories,
  • deleting malicious hidden directories,
  • restoring admin access,
  • resetting passwords,
  • backing up databases and filesystem copies,
  • and running extensive Wordfence scans.

At this point, we are planning to completely remove the current Thrive Theme installation and reinstall fresh clean copies directly from official Thrive sources.

I wanted to notify your security/development team because:

  1. the malware repeatedly appeared within Thrive-related directory structures,
  2. attackers may be targeting common Thrive installation paths,
  3. and additional hardening or integrity validation tools may be warranted.

I am not claiming Thrive itself caused the breach, but Thrive-related directories were heavily involved in the persistence locations identified during cleanup.

Thank you,
Mark Rauterkus
SwimISCA.org

Thrive Theme Support

May 17, 2026 (on a Sunday, BTW, MR notes)

Hello there,

Thank you for reaching out and for taking the time to document and share this in such detail. I'm sorry to hear your sites were affected by a compromise of this scale.

To clarify, Thrive Themes directories are not immune to being used as persistence locations when a hosting environment or WordPress installation is compromised at a broader level. Attackers commonly target writable directories inside popular plugins and themes precisely because they can blend in. This does not indicate a vulnerability in Thrive Themes products themselves, and we are not able to conduct forensic investigations into hosting-level or server-level incidents on your behalf.

Regarding the .storage directory specifically, this is not something Thrive Themes creates, ships, or references anywhere in our codebase. It is attacker-planted. The parent path under global-fields/modals/ is a legitimate Thrive Themes structure, which is likely why it was chosen as a hiding spot, but the .storage folder and everything inside it has no connection to Thrive Themes products.

For the reinstall, your plan is the right call. We recommend doing the following:

1. Delete the .storage directory and all its contents under the modals/ path.

2. Compare the modals/ folder to a clean install. It should contain exactly three files: field.phtml, edit-group.phtml, and delete.phtml. Remove anything else.

3. Reinstall Thrive Theme and Thrive Dashboard from a fresh download via your Thrive Themes account dashboard.

4. Do the same for WordPress core and any other plugins involved. Since wp-includes files were also modified, replacing core entirely is important.

5. After cleanup, rotate all credentials, review admin user accounts, and audit file permissions on wp-content.

If you run into any issues during the reinstallation process, please don't hesitate to reach out and I'll be happy to help.

Best regards,

Thrive Themes
--
Belen

Technical Support

support@thrivethemes.com

--

**Our Standard Support Hours are 9am - 5pm ET, Monday through Friday. While we may respond to tickets outside of this support window, that is not the norm. Thank you for your patience and we’ll respond to any additional questions you may have as soon as possible.**

Legal Disclaimer: responses do not constitute legal advice.

Doing this deep dive and WordFence reported this, so I wanted to pass it along to you too.

Thank you for passing this along.

The notices you are seeing are not related to the malware or the compromise. They are PHP deprecation warnings, which are a different category entirely. A deprecation warning means that a specific coding pattern used in an older part of the codebase is no longer recommended in PHP 8.2 and will eventually stop working in a future PHP version. It does not mean anything is broken right now, and it is not a sign of an attack or a security issue.

In this case, the warnings are coming from an internal component that handles plugin update checking for Thrive products. The way it processes update information was written before PHP 8.2 introduced stricter rules around how objects handle data. Your server is simply flagging it as outdated behavior.

I have checked our system and this is already on the development team's radar.

Please let me know if you have any other questions as you continue with the reinstallation.

Best regards,

Source: helpdesk.WordPress.2026-06-05.xml · Original ID: 4899