Remove phpinfo()

Using phpinfo() can expose the entire server configuration to my users, including every environment variable.

How do I fix it?

Remove any usage of phpinfo from my codebase or from Wordfence settings? And If I removed from codebase then site will break?

Subissues

wp-content/plugins/wordfence/lib/menu_tools_diagnostic.php

Critical

Line 763 in menu_tools_diagnostic.php

<?php if (wfUtils::funcEnabled('phpinfo')) { phpinfo(); } else { echo '<strong>' . esc_html__('Unable to output phpinfo content because it is disabled', 'wordfence') . "</strong>\n"; } ?>

wp-content/plugins/wordfence/lib/sysinfo.php

Line 11 in sysinfo.php

if (wfUtils::funcEnabled('phpinfo')) { phpinfo(INFO_ALL); } else { echo '<center><strong>' . esc_html__('Unable to output phpinfo content because it is disabled', 'wordfence') . "</strong></center>\n"; }

wp-content/plugins/wordfence/lib/wordfenceClass.php

Line 4019 in wordfenceClass.php

if (wfUtils::funcEnabled('phpinfo')) { phpinfo(); } else { echo "\n\n" . __('Unable to output phpinfo content because it is disabled', 'wordfence') . "\n\n"; }

wp-content/plugins/wordfence/views/diagnostics/text.php

Line 556 in text.php

if (wfUtils::funcEnabled('phpinfo')) { phpinfo(); } else { echo "\n\n" . __('Unable to output phpinfo content because it is disabled', 'wordfence') . "\n\n"; }