Fatal Error Members (version 3.2.27)

  • Resolved Mary Ace

    (@hlikes)


    6 days ago

    Hi, see below for info regarding a fatal error. Note that PHP was updated to 8.3, but the plugin was still throwing the error and WP forcing recovery mode.

    Rolling back to 3.2.26 resolved the issue for now.


    From the email:

    WordPress version 7.1.3
    Active theme: ICF Astra Child Theme (version 1.0.0)
    Current plugin: Members (version 3.2.27)
    PHP version 8.2.34



    Error Details
    =============
    An error of type E_ERROR was caused in line 247 of the file /home/redacted/public_html/wp-content/plugins/members/members.php. Error message: Uncaught Error: Failed opening required ‘/home/redacted/public_html/wp-content/plugins/members/admin/class-user-edit.php’ (include_path=’.:/opt/alt/php82/usr/share/pear:/opt/alt/php82/usr/share/php:/usr/share/pear:/usr/share/php’) in /home/redacted/public_html/wp-content/plugins/members/members.php:247
    Stack trace:
    #0 /home/redacted/public_html/wp-content/plugins/members/members.php(101): Members_Plugin->includes()
    #1 /home/redacted/public_html/wp-content/plugins/members/members.php(623): Members_Plugin::get_instance()
    #2 /home/redacted/public_html/wp-content/plugins/members/members.php(627): members_plugin()
    #3 /home/redacted/public_html/wp-settings.php(597): include_once(‘/home/redacted…’)
    #4 /home/redacted/public_html/wp-config.php(117): require_once(‘/home/redacted…’)
    #5 /home/redacted/public_html/wp-load.php(50): require_once(‘/home/redacted…’)
    #6 /home/redacted/public_html/wp-admin/admin-ajax.php(22): require_once(‘/home/redacted…’)
    #7 {main}
      thrown

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author cartpauj

    (@cartpauj)

    5 days, 18 hours ago

    Hi Mary, I checked the official 3.2.27 package and admin/class-user-edit.php is in it (that file didn’t change in this release), so it looks like the update didn’t fully copy over on your site. Could you delete the members folder and install 3.2.27 fresh (Plugins > Add New > Upload Plugin, or via FTP)? Your settings are stored in the database, so nothing is lost. If the file disappears again after that, your host’s security scanner (Imunify or similar) may be removing it, so it’s worth asking them to check their quarantine log. Let us know how it goes!

    Thread Starter Mary Ace

    (@hlikes)

    5 days ago

    Thank you! I don’t see those errors in the log anymore. Deleting and reinstalling should have been my first action before posting here… Apologies for the trouble.

    Your detailed response was much appreciated.

    Thread Starter Mary Ace

    (@hlikes)

    2 days ago

    Hi,

    I wanted to provide an update as the missing file was becoming a recurring issue.

    I identified the cause, and I thought it would be useful to share this in case other Members users encounter the same problem.

    Our hosting provider confirmed that Linux Malware Detect (Maldet) was repeatedly identifying and quarantining the following legitimate plugin file:

    /wp-content/plugins/members/admin/class-user-edit.php

    The file was being moved to:

    /usr/local/maldetect/quarantine/

    This caused WordPress fatal errors because Members could no longer load the required file.

    Our host investigated and confirmed that the quarantined file matched the legitimate plugin source, including the current plugin and GitHub versions.

    They have now restored the file and implemented an ignore rule to prevent Maldet from quarantining it again.

    It therefore appears that the legitimate Members plugin file is triggering a false-positive detection associated with the Sanesecurity signature Sanesecurity.Phishing.Pay.5799.

    I wanted to bring this to your attention because other hosting providers using Maldet or the same detection signatures may encounter similar problems.

    It may be worth reporting this false positive or investigating whether the signature can be corrected upstream, rather than requiring individual hosting providers to whitelist the file.

    The Maldet detection line:

    {CAV}Sanesecurity.Phishing.Pay.5799 :
    /home/[redacted]/public_html/wp-content/plugins/members/admin/class-user-edit.php
    => /usr/local/maldetect/quarantine/class-user-edit.php.925511260

    Plugin Author cartpauj

    (@cartpauj)

    1 day, 18 hours ago

    Thanks for tracking this down and sharing it, Mary! We checked class-user-edit.php against the current Sanesecurity signature set and it doesn’t match anything, and Phishing.Pay.5799 is no longer in their database, so it looks like a retired signature your host’s copy still had. It may be worth asking them to update their Sanesecurity signatures, which should let them remove the ignore rule.

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.