Version 6.1.12 Undefined index: coreUnknown

Please address this issue ASAP. I support over 40 site that get scanned 4 time per day. I get an email on every PHP error written to the error log. This is blowing up my inbox with almost 200 emails a day.

Hi guys,

I don’t think this error is purely cosmetic. Its seems to be the latest hacker malware blocker implementation against Wordfence & WordPress.

As of recent the latest trick is the “Undefined index: coreUnknown” is an actual file injection to prevent malware from being noticed.

Please review my attached image of the infected file and the original clean file
side by side.

https://plumppixel.com/injected_file.jpg

In order to correct the issue, just go to the Wordfence “scan”, start a new scan once done the problem files will show up at the bottom. When you see the “wordfenceHash.php” you can click on the text links below the details paragraph on “restore to original file” and that should fix it.

Make sure to always back up those clean sites before you do anything else and
Good luck to everyone fighting off these WordPress troglodytes!

Starting a brand new scan came up with “Congratulations! No security problems were detected by Wordfence.”

I’ve been getting same error (below) in my scans and tons of bots are hitting wp-login.

Notice: Undefined index: coreUnknown in /[myWebServer]/public_html/wp-content/plugins/wordfence/lib/wordfenceHash.php on line 141 0

If you could release a fix, that would be great.

edgardos writes: “In order to correct the issue, just go to the Wordfence “scan”, start a new scan once done the problem files will show up at the bottom. When you see the “wordfenceHash.php” you can click on the text links below the details paragraph on “restore to original file” and that should fix it.”

[Aug 10 07:33:13] Notice: Undefined index: coreUnknown in /home/xxxxx/wordfenceHash.php on line 141

I do not see the option to restore the original file. There are no clickable links in my Scan Detailed Activity window. In fact, the scan tells me I have 3 issues to fix, all of which concern plugins it would like updated.

I also am getting this error. Why is this thread marked as resolved when it is not?

@kldckldc: for the bots hitting your login, use a plugin called “rename-login” and change the name of your login page to something else. You can change it back once the bots have stopped.

@ taastrategies there should be some links towards the bottom of the actual scan page, if they are still not showing up, thru ftp or your hosting file manager, I have replaced the wordfencehash.php with a correct backup/archive version. I would still get the error ,but then I would run the scan again and then it would show the “restore to old file” blue text links.

@syzygist The problem I think is with wordfence not wordpress. I am sure there are similar discussions going on within the wp community already, hopefully an update from wordfence or wordpress will appear quickly.

Good Luck!

@edgardos, thank you. I will try “rename login”, etc., as you suggest.

Also I am not seeing the deleted lines that you posted in the file injection (they are still in tact):

https://plumppixel.com/injected_file.jpg

In other words, my wordfence.php file looks like your clean file but I’m getting that same error as everyone else.

And..as someone else mentioned, no IPs are being blocked that I asked to have blocked this morning and yesterday — yes I know there is a time limit but they did not show up on the blocked IP list at all. Nothing is on my blocked list……

hi kldckldc

Your file may have another problem. If you have an older back up maybe you can swap them out, if not perhaps export your wordfence settings, delete and reinstall a fresh copy of wordfence and import your settings again. (Note: You may lose some blocking lists already created so its a very last option at the least)

Also, for the blocking not being enabled. I would check the “options” section, top area “Basic Options” and make sure:
-Enable Rate Limiting and Advanced Blocking is checked.

After that not sure what else it maybe at this point,
unless we look deeper under the hood.
Hope that helps.

Hello all,
fix for the “coreUnknown” notice is coming with the next release. We are currently testing it so it will be out soon. As sterndata and wfalaa have already mentioned, it is simply a notice and it does not affect your Firewall or scan. Your sites are safe.

Thanks for your patience.

I’m not sure if this is a permanent fix but I deactivated and then activated Wordfence and the “undefined index wp-content/plugins/wordfence/lib/wordfenceHash.php on line 141” seems to be gone.

Thanks @edgardos. Somehow, Wordfence started magically working overnight. I’m still getting the “coreUnknown” error but very relieved that a fix is on the way. I can now add “blocked IPs” and they are working.

Thanks @wfasa for the notification of fix on the way!

The new Wordfence update Version 6.1.14 has NOT solved this problem

Hello Brian,
it is solved. The ticker area shows last scan activity so if you are still seeing the message in the blinking area just run a fresh scan and it will be gone.

OK thanks! That’s done it.

Problem seems to be fixed, thanks!