Replies: 0
Hello
I am a hsoting provider, and today I found that most of my wordpress hosted accounts have some php code injected all over (mostly) Wordfence scripts.
Code is
< ? php exit(‘Access denied’); __halt_compiler(); ? >
(added some extra spaces on purpose)
This is the list of scripts where this code appeared:
wp-content/plugins/wordfence/lib/wordfenceClass.php
wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/storage/file.php
wp-content/wflogs/template.php
wp-content/wflogs/config.php
wp-content/wflogs/ips.php
wp-content/wflogs/config-synced.php
wp-content/wflogs/config-transient.php
I manually removed those lines, but Wordfence now throws some PHP warnings. I think the best move is to reinstall it.
So the question is: how was this injected?
Thanks