Nulled plugins and themes are paid WordPress add-ons with the licence check cracked out, shared for free on download sites. They’re one of the most reliable ways to get a site hacked, because the person cracking them can add anything they like to the code. Many owners only find out after an infection that their developer installed one to save a licence fee.
Key takeaways
- A nulled plugin is modified code from an unknown source. You can’t tell what was added.
- Hidden backdoors can sit quietly for weeks before they activate.
- Nulled software can’t receive official updates, so known security holes stay open.
- Deleting the plugin isn’t enough if it has already planted malware elsewhere.
- A licence for the real plugin almost always costs less than one clean-up.
What does “nulled” actually mean?
Premium plugins and themes, such as page builders, form tools and booking systems, check for a valid licence before they’ll update or switch on paid features. A nulled copy has that check removed or bypassed. It’s then shared on “GPL club” sites, forums and file-sharing links, usually free or for a few dollars.
The trouble is the middle step. Somebody you’ll never meet has opened the code and changed it. Sucuri, which cleans hacked sites for a living, says malicious code, trojans and backdoors are “routinely injected into nulled plugins” before they’re shared (Sucuri, March 2026).
Isn’t WordPress software free to share anyway?
Partly, and that’s where the confusion comes from. WordPress is released under the GPL, and WordPress.org’s view is that “plugins and themes are derivative work and thus inherit the GPL license”. It also admits there’s “some legal grey area” about what counts as a derivative work (WordPress.org).
But the licence question isn’t the real risk. Even where sharing the code is allowed, it doesn’t make a stranger’s modified copy safe. And you still don’t get updates or support from the developer who wrote it.
How do nulled plugins infect a website?
The patterns repeat. Here’s what the added code typically does once installed:
- Plants a backdoor. A hidden file or function lets the attacker back in, even after passwords change.
- Creates a hidden admin user. Sucuri calls unexpected administrator accounts “a classic sign of a backdoor at work”.
- Waits. Payloads “can sit dormant for weeks or months”, according to Sucuri, so the link to the download is easily forgotten.
- Spreads. Malicious code is copied into theme files, wp-config.php or .htaccess, which Sucuri describes as common hiding spots for redirects.
- Earns money for the attacker. Spam pages in Google, redirects to scam sites, card skimming at checkout, or your server sending spam email.
This matches what clean-up firms find on hacked sites generally. Sucuri’s 2023 report found backdoors on 49% of compromised sites, and malicious admin users in 55% of infected databases (Sucuri).
Why does missing out on updates matter so much?
Even a nulled plugin with no malware in it is a problem, because it can’t update. Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins. Heavily exploited flaws were attacked at scale within a median of five hours of becoming known (Patchstack).
When the real developer fixes a hole, licensed sites get the patch. The nulled copy stays on the old version until someone downloads another cracked copy, from another stranger. Our guide on whether WordPress is secure explains why plugins are where the risk lives.
How can I tell if my site uses nulled software?
You may not know, especially if a developer built the site and has since moved on. Check these:
- List your premium plugins and themes. In WordPress, go to Plugins and Appearance > Themes. Note anything that isn’t from the free WordPress.org directory.
- Look for a licence. Each premium item should show an active licence key or an account with the vendor. “Licence not activated” warnings that someone has hidden are a red flag.
- Ask for receipts. Ask whoever built the site which licences they bought, and in whose name. Licences held only in a former developer’s account will lapse when they stop paying.
- Check update status. A premium plugin that never offers updates, or is years behind the vendor’s current version, deserves a closer look.
- Review admin users. Any administrator account you don’t recognise needs explaining today.
I’ve found one. What now?
Don’t simply delete it and move on. Deleting the plugin removes its own files, but not anything it has already planted elsewhere, such as backdoor files, admin users or code added to your theme. Work through it properly:
- Take a full backup first, so nothing is lost while you investigate.
- Buy a genuine licence and install a fresh copy from the vendor.
- Scan every file and the database for malware, and check for unknown admin users.
- Change all passwords: WordPress, hosting, database and FTP.
- If anything suspicious turns up, treat the site as hacked and get it cleaned properly.
If customer data could have been exposed, read our guide to Privacy Act basics for small business websites. And for a sense of what’s at stake, see the cost of a hacked website for a small business.
How do I make sure it doesn’t happen again?
Agree a simple rule with anyone who works on your site: every plugin comes from WordPress.org or straight from its vendor, with the licence in the business’s name. Keep a list of what’s installed and when each licence renews. Fewer plugins means fewer licences, fewer updates and a smaller target.
The rest is ongoing care. Website security monitoring picks up changed files and new admin users quickly, and secure web hosting should add a firewall and malware scanning at the server. Our website maintenance plans cover both, plus premium plugin updates on Advantage and Elite. For the wider picture, our article on small business cyber security in Australia is a good next read.
Frequently asked questions
Are GPL plugin club sites safe?
You can’t verify them. Some may redistribute untouched code, but you have no way to check what was changed, and you won’t get updates or support from the original developer. For a business website, buying the licence from the vendor is the only option you can trust.
Can a security plugin detect nulled code?
Sometimes. Scanners catch known malware and files that differ from the official version. Well-hidden or new backdoors can slip through, especially in premium plugins that scanners can’t compare against a public copy. Scanning helps, but it doesn’t make nulled software safe.
My developer used a nulled theme. Do I need a new website?
Usually not. Buy a genuine licence for the same theme, replace the files with a clean copy, and have the whole site scanned and checked. If your developer made changes to the theme’s own files, those need moving to a child theme first.
Why would a nulled plugin work perfectly for months?
Because that’s the point. Malicious code is often written to stay quiet so it isn’t noticed and removed. It may only activate on certain requests, or wait until it receives instructions. A site that looks fine can still be compromised.
Are free plugins from WordPress.org any safer?
They come from a known source, the code is public and updates arrive through your dashboard. They can still have security holes, so the same rules apply: install only what you need, keep it updated, and remove plugins that haven’t been updated by their developer in a long time.
Sources
- The Security Risks of Using Nulled WordPress Plugins, Sucuri, March 2026
- License, WordPress.org
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- State of WordPress Security in 2026, Patchstack