Malware detecting malicious code on woocommerce-paypal-payments-nl_NL.l10n.php

Hello @estebandido

Thanks for reporting this.

This sounds like a case of malicious code pretending to be part of the PayPal Payments plugin. The file woocommerce-paypal-payments-nl_NL.l10n.php is not part of the official plugin and repo. Should not exist in the plugin directory: https://github.com/woocommerce/woocommerce-paypal-payments

While the filename may look like a harmless translation file, .l10n.php is not a format we use. This either false positive or some tactic used in compromised sites, where attackers disguise malicious code using names that blend in. To be clear, this is not caused by the PayPal Payments plugin itself. The malicious file was likely injected externally and is only placed in the plugin folder to avoid detection.

Could you please share the exact output or report from the plugin or scanner that flagged this file?

We recommend the following:

• Delete the suspicious file immediately.
• Perform a full malware scan of your site.
• Check for other unknown .php files in your plugins, themes, and uploads directories.
• Consider resetting your admin passwords and reviewing user accounts.

Looking forward to your update.

Kind Regards,
Krystian

Hello @estebandido

Please follow these steps to share your system status report with us:

1. Navigate to the WooCommerce / Status section in your site’s admin panel.
2. Click on the Get system report button and then click Copy for support.
3. Paste the report into our PrivateBin.
4. After uploading, please share the link here so we can review the details thoroughly.

We are waiting for your system reports to proceed with the analysis.

Kind regards,
Krystian

Hello @estebandido

If you have a copy of the exact scan output or report that flagged the file, please provide it. Additionally, if you can share the specific .l10n.php file that triggered the warning, that would be helpful.

For privacy and security reasons, please do not upload it publicly. Instead, open a ticket with our service desk using the link below: Request Support

Be sure to include the URL of this conversation in your ticket so we can track the case accurately.

Once we receive the details, we’ll review it.

Kind Regards,
Krystian

Hello @estebandido,

Thanks for the update.

We reviewed a similar file provided by another user in a related thread, and there is nothing that indicates the PayPal Payments plugin plays any role in generating anything harmful. The file appears to be a standard translation file, automatically created with entries like:

<?php
return [
  'x-generator' => 'GlotPress/4.0.1',
  'project-id-version' => 'Plugins - WooCommerce PayPal Payments - Stable (latest release)',
  'language' => 'es',
  'messages' => [
    'Activate your Installments' => 'Activa tus plazos',
    ...
  ]
];

Since we don’t have access to the file that was flagged on your side, we can’t confirm any issue. Based on what we’ve seen so far, this looks like a false positive from the malware scanner.

I’d recommend checking with your hosting provider if this happens again, especially if the file is deleted before a review can be done.

Kind Regards,
Krystian