Support » Plugin: Wordfence Security - Firewall & Malware Scan » Critical Errors Due to Wordfence

  • Resolved brightervision

    (@brightervision)


    Hello,

    We run over 5k WordPress websites and are seeing issues similar to what your other users described where WordFence is causing critical errors on websites. This is relatively recent and we are only noticing it within the last 24 hours or so, although it could have been going longer.

    De-activating WordFence allows the website to load properly. Here is a sample from the error log:

    [15-May-2020 17:17:08 UTC] WordPress database error Commands out of sync; you can’t run this command now for query SELECT *, CASE
    WHEN type = 3 THEN 0
    WHEN type = 4 THEN 1
    WHEN type = 7 THEN 2
    WHEN type = 6 THEN 3
    WHEN type = 5 THEN 4
    WHEN type = 9 THEN 5
    WHEN type = 8 THEN 6
    WHEN type = 2 THEN 7
    WHEN type = 1 THEN 8
    ELSE 9999
    END AS typeSort, CASE
    WHEN type = 3 THEN parameters
    WHEN type = 4 THEN parameters
    WHEN type = 1 THEN IP
    WHEN type = 9 THEN IP
    WHEN type = 5 THEN IP
    WHEN type = 6 THEN IP
    WHEN type = 7 THEN IP
    WHEN type = 2 THEN IP
    WHEN type = 8 THEN IP
    ELSE 9999
    END AS detailSort
    FROM wpi5_wfblocks7 WHERE type IN (7) AND (expiration = 0 OR expiration > UNIX_TIMESTAMP()) ORDER BY typeSort ASC, id DESC made by wfWAFIPBlocksController::synchronizeConfigSettings, wfBlock::lockouts, wfBlock::allBlocks

Viewing 14 replies - 1 through 14 (of 14 total)
  • Hey @brightervision,

    This could be due to the MySQL version or storage engine you’re using.

    Can you send me a Diagnostics report so I can get a better overview of your environment? Please navigate to Wordfence > Tools > Diagnostics. Here you can select SEND REPORT BY EMAIL. Please include your WordPress.org username and update this thread after you’ve sent it.

    Thanks,

    Gerroald

    Thread Starter brightervision

    (@brightervision)

    Hi Gerroald,

    I would be glad to do this, but the problem is I cannot get into the website with WordFence activated. I need to de-activate WordFence in order for the 500 error to go away.

    If I change the Plugin name to fix the site, log in, and then revert the plugin name back to the proper name, I can then attempt to activate the plugin. However, it triggers a Critical Error and WP automatically de-activates.

    Is there a way to get the Diagnostics report via FTP? Or via phpmyadmin? I deleted it off of the most recent account with this issue, but I feel confident we will encounter it again unfrotunately.

    For additional context:

    – This has happened across multiple servers of ours, with about 30 sites so far. A small number compared to how many we manage, but certainly significant.
    – This appears to only have started Sunday.
    – All our servers utilize Litespeed
    – PHP Versions = 7.3

    Hey @brightervision,

    Ah, yes, I understand.

    Are you able to share your MySQL information including version and storage engine? If you’re not sure where this information is your host can provide it to you.

    Please do let me know.

    Thanks,

    Gerroald

    Thread Starter brightervision

    (@brightervision)

    Hi Gerroald,

    My MYSQLinformation is 7.3 and we use Litespeed.

    What additional information can I provide? We are finding more and more accounts like this.

    Thank you

    Thread Starter brightervision

    (@brightervision)

    As an update:

    This server is on MySQL 5.7.

    Storage engine appears to be mostly myisam, with three using innodb

    ===
    # ls -1tr /var/lib/mysql/REDACTED_wpXXX/ | awk -F\. ‘{print $NF}’ | sort | uniq -c | sort -n
    1 opt
    3 ibd
    68 MYD
    68 MYI
    71 frm
    ===

    The three tables using innodb are:
    ===
    ls -1 /var/lib/mysql/REDACTED_wpXXX/*.ibd
    wptf_wfls_2fa_secrets.ibd
    wptf_wfls_settings.ibd
    wptf_wprss_logs.ibd

    —-

    As my team has dug into this further, if a website is experiencing this issue, we are able to get the site to load if we refresh it and kill the loading at just the right time, before WordFence has had a chance to wipe the output and kill the site.

    Basically, if you keep mashing refresh randomly you will eventually get the site to load. Our working theory is that WF is hooking in after the site has been rendered, cleaning the output buffer, doing some checks, and crashing. If you get the timing just right, it will load.

    We are happy to provide access to a broken site, but I would need to be able to communicate this in a non-public forum 😉

    Thread Starter brightervision

    (@brightervision)

    Hi Gerroald,

    Sorry for so many replies. We have been actively looking into this.

    We operate 5k+ WordPress websites and so we have a fairly large pool to look at.

    Last week, approximately 1% of accounts on our network had this issue. It was fixed by removing WordFence. This week, over the weekend, another 1% had this issue. We are now digging in deeper and trying to troubleshoot the issue as opposed to just deleting WordFence.

    We strongly believe this has to do with a corrupted WF DB entry named emailedIssuesList in WFConfig. When we re-name that entry, the site (with WF installed), runs without issue.

    After doing this, I was able to login and email the Diagnostics report to wftest@wordfence.com. I have emailed this Diagnostics report to you from 2 different websites.

    We have looked closely at 3 accounts so far and have found this WF DB entry named emailedIssuesList to be the problem in all 3.

    We strongly feel that this is the cause of these 500 errors.

    Our team is continuing to investigate to see if we can get to the root of this more clearly.

    If you’d like to communicate directly with me, my email address is perryr AT brightervision dot com

    Thread Starter brightervision

    (@brightervision)

    I wanted to follow-up on this as this is continuing to persist and it is 100% due to the WF DB entry named emailedIssuesList in WFConfig.

    We are seeing the memory limit needing to be set to nearly 1GB in order for this to de-serialize.

    Having the same issue on 1-2 sites.

    • This reply was modified 1 year, 1 month ago by dccreatives.

    Everytime my site crashes. THe only way to reactivate the wordfence plugin is to delete all the tables and do a remove and reset. Very upsetting. THis is happening on certain sites and I realized the common thread is 2 of the 3 are running the7 theme. But one is not.

    Im seeing this after converting to litespeed web server today @wfgerald.

    Hi All,

    The MySQL documentation say that this error is caused by incorrectly using a couple functions that Wordfence doesn’t use:

    https://dev.mysql.com/doc/refman/8.0/en/commands-out-of-sync.html

    Therefore it could be being caused by the following:

    1) Your theme or another plugin is using one of those functions.

    2) Also, mysql_use_result() is used internally in PHP (in the C source) and not necessarily as a PHP function. It’s possible certain PHP versions have a bug that may call it when it shouldn’t happen so the version of PHP your site is running under could be the cause.

    Can you please share your server/system information so we can take a closer look and compare them?

    Please let me know.

    Thanks,

    Gerroald

    Hi All,

    A list of your active plugins may be helpful as well.

    Thanks again,

    Gerroald

    My Error is slightly different

    [23-Jun-2020 18:34:58 UTC] WordPress database error Commands out of sync; you can't run this command now for query SELECT option_value FROM myst_options WHERE option_name = '_site_transient_timeout_wc_pb_db_sync_task_runner_manual_lock' LIMIT 1 made by shutdown_action_hook, do_action('shutdown'), WP_Hook->do_action, WP_Hook->apply_filters, WC_PB_DB_Sync::sync, get_site_transient, get_site_option, get_network_option, get_option
    [23-Jun-2020 18:34:58 UTC] WordPress database error Commands out of sync; you can't run this command now for query SELECT option_value FROM myst_options WHERE option_name = '_site_transient_wc_pb_db_sync_task_runner_manual_lock' LIMIT 1 made by shutdown_action_hook, do_action('shutdown'), WP_Hook->do_action, WP_Hook->apply_filters, WC_PB_DB_Sync::sync, get_site_transient, get_site_option, get_network_option, get_option
    [23-Jun-2020 18:34:58 UTC] WordPress database error Commands out of sync; you can't run this command now for query 
    			SELECT COUNT(*)
    			FROM myst_options
    			WHERE option_name LIKE 'wp\\_1\\_wc\\_pb\\_db\\_sync\\_task\\_runner\\_batch\\_%'
    		 made by shutdown_action_hook, do_action('shutdown'), WP_Hook->do_action, WP_Hook->apply_filters, WC_PB_DB_Sync::sync, WC_PB_DB_Sync_Task_Runner->is_queued, WP_Background_Process->is_queue_empty
    [23-Jun-2020 18:34:58 UTC] WordPress database error Commands out of sync; you can't run this command now for query SELECT *, CASE 
    WHEN type = 3 THEN 0
    WHEN type = 4 THEN 1
    WHEN type = 7 THEN 2
    WHEN type = 6 THEN 3
    WHEN type = 5 THEN 4
    WHEN type = 9 THEN 5
    WHEN type = 8 THEN 6
    WHEN type = 2 THEN 7
    WHEN type = 1 THEN 8
    ELSE 9999
    END AS typeSort, CASE 
    WHEN type = 3 THEN parameters
    WHEN type = 4 THEN parameters
    WHEN type = 1 THEN IP
    WHEN type = 9 THEN IP
    WHEN type = 5 THEN IP
    WHEN type = 6 THEN IP
    WHEN type = 7 THEN IP
    WHEN type = 2 THEN IP
    WHEN type = 8 THEN IP
    ELSE 9999
    END AS detailSort
     FROM myst_wfBlocks7 WHERE type IN (4) AND (expiration = 0 OR expiration > UNIX_TIMESTAMP()) ORDER BY typeSort ASC, id DESC made by wfWAFIPBlocksController::synchronizeConfigSettings, wfBlock::patternBlocks, wfBlock::allBlocks
    [23-Jun-2020 18:34:58 UTC] WordPress database error Commands out of sync; you can't run this command now for query SELECT *, CASE 
    WHEN type = 3 THEN 0
    WHEN type = 4 THEN 1
    WHEN type = 7 THEN 2
    WHEN type = 6 THEN 3
    WHEN type = 5 THEN 4
    WHEN type = 9 THEN 5
    WHEN type = 8 THEN 6
    WHEN type = 2 THEN 7
    WHEN type = 1 THEN 8
    ELSE 9999
    END AS typeSort, CASE 
    WHEN type = 3 THEN parameters
    WHEN type = 4 THEN parameters
    WHEN type = 1 THEN IP
    WHEN type = 9 THEN IP
    WHEN type = 5 THEN IP
    WHEN type = 6 THEN IP
    WHEN type = 7 THEN IP
    WHEN type = 2 THEN IP
    WHEN type = 8 THEN IP
    ELSE 9999
    END AS detailSort
     FROM myst_wfBlocks7 WHERE type IN (3) AND (expiration = 0 OR expiration > UNIX_TIMESTAMP()) ORDER BY typeSort ASC, id DESC made by wfWAFIPBlocksController::synchronizeConfigSettings, wfBlock::countryBlocks, wfBlock::allBlocks
    [23-Jun-2020 18:34:58 UTC] WordPress database error Commands out of sync; you can't run this command now for query SELECT *, CASE 
    WHEN type = 3 THEN 0
    WHEN type = 4 THEN 1
    WHEN type = 7 THEN 2
    WHEN type = 6 THEN 3
    WHEN type = 5 THEN 4
    WHEN type = 9 THEN 5
    WHEN type = 8 THEN 6
    WHEN type = 2 THEN 7
    WHEN type = 1 THEN 8
    ELSE 9999
    END AS typeSort, CASE 
    WHEN type = 3 THEN parameters
    WHEN type = 4 THEN parameters
    WHEN type = 1 THEN IP
    WHEN type = 9 THEN IP
    WHEN type = 5 THEN IP
    WHEN type = 6 THEN IP
    WHEN type = 7 THEN IP
    WHEN type = 2 THEN IP
    WHEN type = 8 THEN IP
    ELSE 9999
    END AS detailSort
     FROM myst_wfBlocks7 WHERE type IN (1, 8, 9, 2, 5, 6) AND (expiration = 0 OR expiration > UNIX_TIMESTAMP()) ORDER BY typeSort ASC, id DESC made by wfWAFIPBlocksController::synchronizeConfigSettings, wfBlock::ipBlocks, wfBlock::allBlocks
    [23-Jun-2020 18:34:58 UTC] WordPress database error Commands out of sync; you can't run this command now for query SELECT *, CASE 
    WHEN type = 3 THEN 0
    WHEN type = 4 THEN 1
    WHEN type = 7 THEN 2
    WHEN type = 6 THEN 3
    WHEN type = 5 THEN 4
    WHEN type = 9 THEN 5
    WHEN type = 8 THEN 6
    WHEN type = 2 THEN 7
    WHEN type = 1 THEN 8
    ELSE 9999
    END AS typeSort, CASE 
    WHEN type = 3 THEN parameters
    WHEN type = 4 THEN parameters
    WHEN type = 1 THEN IP
    WHEN type = 9 THEN IP
    WHEN type = 5 THEN IP
    WHEN type = 6 THEN IP
    WHEN type = 7 THEN IP
    WHEN type = 2 THEN IP
    WHEN type = 8 THEN IP
    ELSE 9999
    END AS detailSort
     FROM myst_wfBlocks7 WHERE type IN (7) AND (expiration = 0 OR expiration > UNIX_TIMESTAMP()) ORDER BY typeSort ASC, id DESC made by wfWAFIPBlocksController::synchronizeConfigSettings, wfBlock::lockouts, wfBlock::allBlocks

    We are on a dedicated Cpanel server with litespeed web server – we also have the LS cache enabled, this server DOESN’T have memcached enabled yet

    Plugin Author WFSupport

    (@wfsupport)

    @tworak Per forums rules, please open your own topic. It helps us be able to track the issue.

    Thanks!
    Tim

Viewing 14 replies - 1 through 14 (of 14 total)
  • The topic ‘Critical Errors Due to Wordfence’ is closed to new replies.