[geofft]

It occurs to me that malicious code that scans WordPress etc. sites for vulnerabilities, installs itself, and sends spam and propagates itself does match the general shape of a virus (even to the point where pattern-matching antivirus would genuinely be effective against it). We just for whatever reason tend not to refer to it as a "WordPress virus," but rather e.g. a "reverse shell" or a "botnet."

[Beldin]

I'd call that a worm, not a virus. The main distinction being that a worm propagates all by itself, while a virus requires some user action.