WordFence flagging latest version

  • Resolved gopar3

    (@gopar3)


    6 days, 10 hours ago

    I just got a critical security alert on my website regarding the Calculated Fields plugin. Is this something I should be worried about? The alert reads as follows:

    • Filename: //public_html/wp-content/plugins/calculated-fields-form/inc/cpcff_admin_int_message_list.inc.php
    • File Type: Not a core, theme, or plugin file from wordpress.org
    • Details: Note that this signature detects several older versions of WordPress.org repo plugins that were in violation of the repository guidelines so not all detections are malicious. If all of your plugins are up to date, however, then it is highly likely that files detected by this signature are malicious.
      The matched text in this file is: $_valid_urls($_split_lines($_row_san

      The issue type is: Obfuscated:PHP/HiddenEval.7149
      Description: Suspicious code pattern often seen in obfuscated infections
Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author CodePeople2

    (@codepeople2)

    6 days, 10 hours ago

    Hello @gopar3,

    No, this is a false positive rather than a vulnerability.

    The plugin stores the URLs of the files uploaded through the Upload File fields as a single string containing all file URLs concatenated together. When you edit an entry, the plugin splits that string so that each file URL is displayed on a separate line in the corresponding textarea.

    Could you please let us know which plugin or security scanner is reporting this as a vulnerability? We’d like to contact its developers to clarify the behavior and help prevent future false positives.

    Best regards.

    Plugin Author CodePeople2

    (@codepeople2)

    6 days, 10 hours ago

    Hello @gopar3

    Note as well this feature is in the commercial plugin versions, no the free one. We are not allowed to support any customers in these forums.

    For pro or commercial product support please contact us directly on our site. This includes any pre-sales topics as well.

    Commercial products are not supported in these forums. We will happily answer this and any other questions you can have on our own site.

    Thank you.

    Thread Starter gopar3

    (@gopar3)

    6 days, 10 hours ago

    I’m using the Pro version, so I’ll reach out there. Thanks for the quick reply.

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.