File not found by Wordfence

I have Wordfence on a website which was hacked. I ran a scan and deleted the files suggested. I ran another scan and got “Congratulations” message that no security problems were detected.

I then ran a malware scan with the GOTMLS Anti Malware scan and it found a file in the WordPress core that Wordfence did not pick up:

/wp-includes/pomo/session.php

I opened this file and it was indeed malicious. It is not part of the core so the comparison part of the scan did not work fully.

Thought you ought to know.

Thanks

https://wordpress.org/plugins/wordfence/