A must-use plugin, or mu-plugin, is a WordPress plugin placed in the wp-content/mu-plugins directory. Unlike normal plugins, it loads automatically on every request and does not appear in the standard plugin disable flow, so site admins may not notice it right away. This makes mu-plugins useful for legitimate site-wide controls, but also attractive to attackers who want persistent code execution with minimal visibility.
In real attacks, a malicious mu-plugin can act as a foothold for redirects, payload staging, header tampering, or browser-side manipulation. Defenders should compare the mu-plugins directory against a trusted inventory, review file names that mimic site utilities, and check whether the code is loading unexpected scripts or registering additional components. Because it runs early and quietly, a suspicious mu-plugin can turn a WordPress compromise into a durable delivery mechanism.