diff --git a/src/network-services-pentesting/pentesting-web/wordpress.md b/src/network-services-pentesting/pentesting-web/wordpress.md
index b623bb09f32..cbad34bc426 100644
--- a/src/network-services-pentesting/pentesting-web/wordpress.md
+++ b/src/network-services-pentesting/pentesting-web/wordpress.md
@@ -388,6 +388,29 @@ Change admin password:
 mysql -u <USERNAME> --password=<PASSWORD> -h localhost -e "use wordpress;UPDATE wp_users SET user_pass=MD5('hacked') WHERE ID = 1;"
 ```
 
+### MU-plugin persistence and hidden REST upload backdoors
+
+`WPMU_PLUGIN_DIR` defaults to `wp-content/mu-plugins`. WordPress automatically loads top-level PHP files from this directory before normal plugins; they are absent from the default Plugins list, are not recorded as ordinary active plugins, receive no normal update notices, and cannot be disabled from the standard workflow. Consequently, an attacker with an arbitrary-write primitive can obtain low-visibility persistence by dropping one PHP loader in this directory. Check the separate **Must-Use** view and the filesystem itself rather than relying only on the ordinary plugin inventory.<sup>[[30]](#references)</sup>
+
+A practical pattern is a one-shot conventional plugin or installer that creates the MU-plugin, then deactivates and deletes itself. One recovered implementation registered the obscure REST route `wp-sec/v1/upload`, checked hardcoded credentials, accepted attacker-selected paths beneath the WordPress root, and explicitly permitted `.php`. The credential therefore protected an arbitrary file-write backdoor rather than fixing it: anyone who recovered it could POST a web shell below the web root and gain PHP code execution.<sup>[[31]](#references)</sup>
+
+For an authorized assessment or incident response, enumerate both the autoload directory and REST namespace, then review every upload callback for capability checks, canonical path containment, extension allowlists, and placement outside executable web directories. WordPress only autoloads PHP files directly inside the MU-plugin directory, but a small top-level loader may `require` a larger payload from a subdirectory.<sup>[[30]](#references)[[31]](#references)</sup>
+
+```bash
+# The location can be changed in wp-config.php
+grep -nE 'WPMU_PLUGIN_(DIR|URL)' wp-config.php
+find wp-content/mu-plugins -maxdepth 2 -type f -printf '%TY-%Tm-%Td %TT %p\n' 2>/dev/null
+wp plugin list --status=must-use --fields=name,status,version
+
+# REST discovery and source review
+curl -s https://target.example/wp-json/ | jq -r '.routes | keys[]' | grep -Ei 'upload|file|wp-sec'
+grep -RniE 'register_rest_route|move_uploaded_file|file_put_contents|fopen|copy|ABSPATH|WPMU_PLUGIN_DIR' wp-content/mu-plugins
+```
+
+High-signal artifacts include a new `mu-plugins` directory, REST registrations whose `permission_callback` compares request data to embedded secrets, destination paths derived from client input, self-deleting installers, and a successful `POST /wp-json/<namespace>/<route>` followed by a request to a newly written PHP file. Also investigate small writable state files that hold a payload URL or an `off` switch: a separate controller can rotate infrastructure or toggle injected content without replacing the main plugin. Unexpected cache-plugin deactivation or removal of `WP_CACHE` may be used to ensure that the dynamic lure is served consistently.<sup>[[31]](#references)</sup>
+
+For the client-side delivery stage commonly paired with this compromise, see [Clipboard Hijacking / ClickFix](../../generic-methodologies-and-resources/phishing-methodology/clipboard-hijacking.md) and [PowerShell download-and-execute](../../windows-hardening/basic-powershell-for-pentesters/README.md#download--execute).
+
 ## WordPress plugin pentesting
 
 ### Attack Surface
@@ -1025,4 +1048,6 @@ Hardening
 - [27] [WordPress nonces are not authorization](https://developer.wordpress.org/apis/security/nonces/)
 - [28] [Configuring WordPress automatic background updates](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/)
 - [29] [Hardening WordPress](https://developer.wordpress.org/advanced-administration/security/hardening/)
+- [30] [Must Use Plugins – WordPress Advanced Administration Handbook](https://developer.wordpress.org/advanced-administration/plugins/mu-plugins/)
+- [31] [Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect](https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/)
 {{#include ../../banners/hacktricks-training.md}}