Threat alerts for plugins I don’t have

  • Resolved Emielb

    (@emielb)


    1 year, 3 months ago

    Hi,

    I don’t know at which level the problem is, so I will describe my setup:

    • I use WordFence on about 100 websites
    • I use WordFence Central to monitor them and I get critical problems alerts in Slack

    My problem: for a couple weeks I’ve been receiving alerts about a plugin (Popup builder in this case) on a site, but this plugin isn’t installed and probably never was (the folder doesn’t exist in wp-content/plugins either).

    When I consult the scan results in the site administration area, no problem appears.

    Since I can’t update this plugin, which doesn’t exist on the site, the message comes back.

    Since this morning I’ve had the same problem with another website and another plugin (Post Duplicator).

    I use these plugins on some sites, but not these ones. So I’m wondering if there isn’t a problem in the alerts with the site it’s reporting.

    Thanks for your help!

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support wfmark

    (@wfmark)

    Hi @emielb, Thank you for reaching out.

    In order to assist you, please send a diagnostic report to [email protected] for one of the sites with this issue. You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

    Thanks,

    Mark.

    Thread Starter Emielb

    (@emielb)

    Hi Mark,

    Thanks for your reply! I think I’ve found the source of the problem (this site has been duplicated to another and it’s this one that actually had this alert in Wordfence > Scan). So there’s probably a reference to the old site somewhere.
    Would you like to diagnose the problem in more detail, or is this normal behavior? Would you like me to send a diagnostic report to [email protected] for this site instead?

    Thanks!

    • This reply was modified 1 year, 3 months ago by Emielb.
    Plugin Support wfmark

    (@wfmark)

    Hi @emielb, thanks for getting back to us, and apologies for the delayed response.

    Can you confirm the email address set under Wordfence > All Options > General Wordfence Options > Where to email alerts on the duplicate site?

    Please go ahead and sent a diagnostic report to [email protected]. Do not forget to add your forum username where indicated and respond here after you have sent it.

    Thanks,

    Mark.

    Thread Starter Emielb

    (@emielb)

    Hi @wfmark,

    The e-mail address is correct. I’ve just sent the diagnostic report to [email protected]. It looks like the log only goes back to December 27, so I’m not sure if you’ll get the information you need, but since my problem is solved on my end, I’ll mark this topic as solved.

    In summary, site B (the one for which I sent the report) has been duplicated from site A. I received WordFence alert notifications in Slack with the reference to site A, but the alert was actually located on site B. By resolving the alert on site B, I didn’t receive any other notifications on Slack about site A, so the problem is solved on my end.

    The only weird thing perhaps is that WF probably stores the site URL somewhere in the database, instead of using a function like site_url(), which seems a bit odd.

    Thanks,
    Emielb

    • This reply was modified 1 year, 2 months ago by Emielb.
Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Threat alerts for plugins I don’t have’ is closed to new replies.