Too many PHP error, maybe compromised code?

  • Resolved Jaro

    (@pixtweaks)


    5 days, 7 hours ago

    Hi,
    I just noticed 2000+ PHP errors produced by your plugin so far.
    What’s strange it’s trying to access plugin that never been used on this site /wp-content/plugins/hyve.
    The debug trace is bellow.

    One more note. This appears on different requests, like on ajax and front-end. Please don’t execute your code outside of your menus. Thank you!

    Regards,
    Jaro

    Error 2 - E_WARNING - 1 second ago

    opendir(/wp-content/plugins/hyve): Failed to open directory: No such file or directory

    /wp-admin/includes/plugin.php:297

    #16 [internal function]:0 WPSD\debug\v2\error_handler(2, opendir(/wp-content/plugins/hyve): Failed to open di..., /wp-admin/includes/plugin.php, 297)
    #15 /wp-admin/includes/plugin.php:297 opendir(/wp-content/plugins/hyve)
    #14 /wp-content/plugins/feedzy-rss-feeds/vendor/codeinwp/themeisle-sdk/src/Common/Abstract_module.php:262 get_plugins(/hyve)
    #13 /wp-content/plugins/feedzy-rss-feeds/vendor/codeinwp/themeisle-sdk/src/Common/Abstract_module.php:187 ThemeisleSDK\Common\Abstract_Module->resolve_plugin_main_file(hyve)
    #12 /wp-content/plugins/feedzy-rss-feeds/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php:661 ThemeisleSDK\Common\Abstract_Module->is_plugin_installed(hyve)
    #11 /wp-content/plugins/feedzy-rss-feeds/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php:184 ThemeisleSDK\Modules\Promotions->get_promotions()
    #10 /wp-content/plugins/feedzy-rss-feeds/vendor/codeinwp/themeisle-sdk/src/Common/Module_factory.php:93 ThemeisleSDK\Modules\Promotions->can_load([
    	pro_slug: feedzy-rss-feeds-pro
    ]
    )
    #9 /wp-content/plugins/feedzy-rss-feeds/vendor/codeinwp/themeisle-sdk/src/Loader.php:556 ThemeisleSDK\Common\Module_Factory::attach([
    	pro_slug: feedzy-rss-feeds-pro
    ]
    , [
    	crash_reporter
    	script_loader
    	dashboard_widget
    	rollback
    	uninstall_feedback
    	licenser
    	logger
    	translate
    	translations
    	review
    	recommendation
    	notification
    	promotions
    	welcome
    	compatibilities
    	about_us
    	announcements
    	featured_plugins
    	float_widget
    	migrator
    	ai_connect
    ]
    )
    #8 /wp-content/plugins/feedzy-rss-feeds/vendor/codeinwp/themeisle-sdk/start.php:60 ThemeisleSDK\Loader::add_product(/wp-content/plugins/feedzy-rss-feeds/feedzy-rss-feed...)
    #7 /wp-content/plugins/feedzy-rss-feeds/vendor/codeinwp/themeisle-sdk/load.php:70 require_once(/wp-content/plugins/feedzy-rss-feeds/vendor/codeinwp...)
    #6 /wp-includes/class-wp-hook.php:353 themeisle_sdk_load_latest()
    #5 /wp-includes/class-wp-hook.php:377 WP_Hook->apply_filters(null, [
    	
    ]
    )
    #4 /wp-includes/plugin.php:523 WP_Hook->do_action([
    	
    ]
    )
    #3 /wp-settings.php:779 do_action(init)
    #2 /wp-config.php:166 require_once(/wp-settings.php)
    #1 /wp-load.php:50 require_once(/wp-config.php)
    #0 /wp-admin/admin-ajax.php:22 require_once(/wp-load.php)
Viewing 1 replies (of 1 total)
  • malexandric

    (@malexandric)

    4 days, 3 hours ago

    Hi @pixtweaks ,

    Thanks for the detailed trace.

    The entries come from the Themeisle SDK, a small shared library bundled with our plugins. WordPress is asked to read a folder that doesn’t exist.

    WordPress core expects this. In the line from your trace, wp-admin/includes/plugin.php:297, it calls @opendir(), and the @ tells PHP to silence the warning. That’s why it never shows up in the regular PHP error log. Your debugging tool’s error handler logs warnings even when they’ve been silenced this way, so you see one entry per request. Nothing is executed from that folder and nothing is created.

    Your second point is fair. Feedzy itself has to run outside wp-admin, because shortcodes, blocks and scheduled feed imports all depend on it. This particular check is different, though, so there is no reason for it to run on frontend or ajax requests. I’ve reported both issues to our team: the check shouldn’t look for missing folders, and it should only run where it can actually be used. Both should be fixed in an upcoming release.

    Until then, you can safely ignore these entries or filter them out in your debugging tool. If your tool can skip errors silenced with @, turning that on will hide them too.

    Thanks again for flagging it, and let me know if you spot anything else.

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.