wp-pass.php, wp-register.php Out of Date – Is This Okay?

  • Hi there,

    I’m running the most recent version of WordPress. I’ve even tried hitting the ‘re-install now’ button on the updates page. Despite this, three PHP scripts (wp-app, wp-register, and wp-pass) are outdated. Checking via FTP, I can see these files haven’t been touched since 2012. All the other files are showing the last modified date as today. Is this correct? Should I (or can I) delete these files? Is there somewhere I can get a new/clean version of them without having to reinstall the whole site?

    The reason I ask is because we’ve been hit by a hacker and I want to make sure these aren’t in any way malicious. The code in them looks benign, but it’s hard not to be paranoid after getting attacked, and the user did gain access by creating an ‘admin’ user and deleting every other user. He then modified our .htaccess file to point at a malicious script hidden behind license.html.

    I think I’ve cleaned up everything else, but these outdated scripts are still giving me pause. Should I rest easy about them?

  • The topic ‘wp-pass.php, wp-register.php Out of Date – Is This Okay?’ is closed to new replies.