unknown file: class-walker-post.php

  • Resolved tonyrobertsmn

    (@tonyrobertsmn)


    3 years, 1 month ago

    Some process is repeatedly adding the file /includes/class-walker-post.php to my WP installation and at the same time modifying wp-settings.php to require /includes/class-walker-post.php if it exists. WordFence flags these as changed files, which I delete and repair as needed.

    Some days later, these changed files reappear. This has happened on multiple WordPress sites. Multiple Searches have provided no information about what this class-walker-post.php file is or where it comes from.

    Does anyone have any information about this?

Viewing 1 replies (of 1 total)
  • Plugin Support wfpeter

    (@wfpeter)

    3 years, 1 month ago

    Hi @tonyrobertsmn, thanks for reaching out.

    There are a number of “class-walker-” pages in WordPress, but “post” is not one of them, so it may be necessary to clean your site if code has been inserted to regenerate this file and its inclusion. It isn’t best practice for plugins to insert files into your WordPress core directories, so there’s a lower chance it’s serving an innocent purpose.

    Feel free to send a copy of the file (along with explanation of the wp-settings.php behavior) to samples @ wordfence . com so that we can analyze it. Make sure to always remove passwords/keys/salts from anything you do send to us.

    I will provide our site cleaning instructions for you below, starting with our checklist to follow: https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/

    Make sure to get all your plugins and themes updated and update WordPress core too. If you are on an older branch (WordPress 4.x etc) because you wanted to wait before installing the latest version because of Gutenberg or a custom theme compatibility you still need the latest update in that version. Those can be found here: https://wordpress.org/download/releases/

    WordPress sometimes patches their older releases if they find a vulnerability so make sure to update your version if needed. We, of course, recommend that you update to the latest version.

    As a rule, any time I think someone’s site has been compromised I also tell them to update their passwords for their hosting control panel, FTP,  WordPress admin users, and database. Make sure to do this.

    Additionally you might find the WordPress Malware Removal section in our free Learning Center helpful.  

    If you are unable to clean this on your own there are paid services that will do it for you.  Wordfence offers one and there are others.  Regardless if you choose to clean it yourself or let someone else do so, we recommend that you make a full backup of the site beforehand.

    Thanks,
    Peter.

Viewing 1 replies (of 1 total)

The topic ‘unknown file: class-walker-post.php’ is closed to new replies.