Quick answer
wp-vcd is a self-spreading WordPress malware that infects theme files and injects spam or ads. Remove it by deleting the malicious files it plants (like wp-vcd.php and functions.php injections) across every theme, replacing infected files with clean copies, removing the nulled plugin or theme that introduced it, and hardening the site.
Key takeaways
- wp-vcd almost always comes from a nulled (pirated) theme or plugin.
- It self-replicates across all installed themes, so partial cleanups fail.
- Removing the nulled software and every infected file is the only complete fix.
wp-vcd is one of the most common WordPress infections, and it has a very predictable origin: a nulled theme or plugin. It spreads itself across your site and injects spam or ads. Removing it takes thoroughness, because it copies itself into every theme.
How to recognize it
Look for files like wp-vcd.php, suspicious code at the top of your themes' functions.php, and unexpected admin files. You may also notice injected ads, spam links, or new admin users.
Remove every infected file
Because wp-vcd self-replicates, it plants copies across all installed themes — even inactive ones. Delete the malicious files everywhere, and replace theme and core files with clean copies rather than editing them by hand.
Remove the source
The infection came in with nulled software. Delete the pirated theme or plugin entirely. Keeping it means keeping both the malware's origin and a component that gets no security updates.
Clean the database and users
Check for injected options and unknown admin accounts, remove them, and rotate all passwords and security keys.
Harden and go legitimate
Install a licensed version of whatever you needed, update everything, and add monitoring. The cost of a real license is far less than repeated wp-vcd cleanups.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
Almost always from a nulled (pirated) premium theme or plugin. The crackers bundle the malware inside the free download.
Keep reading
How to Detect and Remove a Credit-Card Skimmer in WooCommerce
A card skimmer quietly steals customer payment details at checkout. Here's how to detect and remove one from WooCommerce.
Website Suspended by Your Host? How to Get It Back Online
If your host suspended your account for malware, here's how to clean the site to their standard and get it reactivated.
How to Request a Google Security Review After a Hack
Cleaned the hack but Google still warns visitors? Here's how to request a security review and get the warning lifted — the right way.