What it is

This plugin or theme is an unofficial ("nulled") copy of a paid product, altered to include a backdoor that gives an attacker remote access to the site — even while the plugin itself appears to work normally.

How to fix it

Remove it and install the official, licensed version instead. A nulled copy never receives security updates, so the backdoor — and any future vulnerability — stays open indefinitely.

In depth

You have a fake or unauthorized copy of a paid plugin on your site that includes secret hidden code giving attackers the ability to take control of your website without your knowledge. This is extremely dangerous because while the plugin appears to work normally on the surface, the backdoor lets someone access your site remotely, steal your data, inject malicious content, or use your site to attack other websites. Because this is a counterfeit version, it never receives security updates from the real developer, meaning any new security problems discovered in the official plugin will remain unpatched on your site forever. To fix this, you need to delete the nulled plugin completely and purchase and install the legitimate, official version from the developer instead. When you use the official version, you get automatic security updates, proper support, and peace of mind knowing there is no hidden code. If you're concerned about cost, many quality plugins offer affordable annual licenses, and protecting your site from being hacked is worth the investment.