Malicious code detected from Wordfence scan

  • Resolved iugoau

    (@iugoau)


    5 months, 1 week ago

    This email was sent from Wordfence plugin to our account :

    Critical Problems:

    • Filename: /wp-content/plugins/miniorange-saml-20-single-sign-on/includes/lib/mo-options-enum.php
    • File Type:?Not a core, theme, or plugin file from www.remarpro.com.
    • Details:?This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is:?= ABSPATH . “\x77
    • Filename:?/wp-content/uploads/backup/miniorange-saml-20-single-sign-on-premium-backup-25.1.8/includes/lib/mo-options-enum.php
    • File Type:?Not a core, theme, or plugin file from www.remarpro.com.
    • Details:?This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is:?= ABSPATH . “\x77
    • Filename:?/wp-content/uploads/backup/miniorange-saml-20-single-sign-on-premium-backup-25.1.6/login.php
    • File Type:?Not a core, theme, or plugin file from www.remarpro.com.
    • Details:?This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is:?base64_decode(“\1

      The issue type is:?Suspicious:PHP/b64obfu.6868
      Description:?Suspicious code pattern often used by malwareCan you please

    We are currently using version 25.2.0 on this site. Can you please confirm if this is malicious code and a security threat or if these are false positive from the Wordfence scan.

Viewing 1 replies (of 1 total)

  • Hi there,

    These are false positive due to the obfuscation of the code which was done to prevent reverse engineering of the code.
    We will make un-obfuscate this particular code in our next release so that Wordfence won’t show this code as malicious.

    Until then, please ignore this warning.

Viewing 1 replies (of 1 total)
  • You must be logged in to reply to this topic.