wfmark

You’re welcome @alamana.

I recommend reviewing the scan results daily or whenever you run a scan to review any modified file results.

Thanks,

Mark

Hi @stefanp44, thanks for reaching out and bringing this to our attention.

I checked with our Threat Intelligence Team and confirmed that the vulnerability has been patched from version 2.5.10. The Vulnerability Database will be updated. 

This should be safe to ignore.

Thanks,

Mark.

Hi @tigrokon, thanks for getting back to us.

Wordfence is a localized firewall that stays on your web server to perform server-side scans at a deeper level.

Wordfence scans the files that are uploaded on your web server. Your files will not be shared with any third parties.

Thanks,

Mark

Hi @pldoolittle,

As per the forum guidelines below, please open your own topic, and we would be glad to assist you:

“Unless users have the exact same version of WordPress on the same physical server hosted by the same hosts with the same plugins, theme, and configurations, then the odds are the solution for one user will not be the same for another. For this reason, we recommend people start their own topics.”

Thanks,

Mark.

Hi @dreame, Thank you for reaching out to us.

Please confirm whether you are using the latest version of WordPress, as we have had cases where updating WordPress fixes the issue.

Issues like this can be caused by plugin or theme conflicts stopping our Javascript from loading correctly or causing errors that mean our code doesn’t get run. Generally, reverting to a default theme and disabling all plugins except Wordfence should hopefully regain your button functions. If it does, re-enable everything else one by one until the issue returns to find the source of the issue.

It’s possible for a repair to be working in the background after the click, then time out. Running the scan again might reveal there are less files to repair than the previous scan if that’s the case. Please inspect the network tab of the console to see if anything was triggered when the button was clicked if the page doesn’t change and share a screenshot with us.

Let me know how it goes.

Thanks,

Mark.

Hello @npanic , and thanks for reaching out to us!

If the firewall is optimized, you can add the line define(‘WFWAF_STORAGE_ENGINE’, ‘mysqli’); after <?php on a new line within /wordfence-waf.php. Wordfence will then save all its firewall data within the database instead of attempting to use the file system. If the firewall is not optimized, you’ll do that via the wp-config.php file. You can check to see if the firewall is optimized via Wordfence > Firewall > All Firewall Options > Protection Level, which will have a button saying “Remove Extended Protection” if it is optimized. Kindly check the link below for more information.

https://www.wordfence.com/help/firewall/mysqli-storage-engine/

Make sure the define(‘WFWAF_STORAGE_ENGINE’, ‘mysqli’); is in the correct bracket in the PHP file.

Please note that we only recommend using this option if your site is unable to read and write to the firewall files consistently or if your host uses multiple web servers that do not share the same filesystem since better performance and efficient resource usage are likely when using the default file-based storage on most hosts.

Thanks,

Mark.

Translation:

Good morning,

Here is the message obtained after a Wordfence scan:

Unknown file in WordPress core: wp-admin/css/colors/blue/php.ini (+ 238 more)Type: File

Issue Found October 12, 2023 8:03 a.m.

Obviously 238 files are problematic and I don’t really know what to do to fix it. First of all, is it possible that this is a reading error? Or is it serious?

Here is the message obtained at the end of the box:

Details: This file is in a WordPress core location but is not distributed with this version of WordPress. This scan often includes files left over from a previous WordPress version, but it may also find files added by another plugin, files added by your host, or malicious files added by an attacker. 238 more similar files were found

Thanks for your help,

Hello @gaelleclairfonce, and thanks for reaching out to us!

If you already know about the listed file, you can click the link to ignore the file until it changes. If you don’t know what the file is, it may require some investigation to find out if your host has placed it there, if your FTP application or OS may have created it, or if it is malicious.

Some “Managed WordPress” hosting plans do not allow you to change core files, and on some hosts, if a new version of WordPress no longer includes a particular file, it may be left in your site’s files after they update WordPress. In this case, it is generally safe to ignore the file, or you can contact the host if you believe it should be removed.

In a few cases, we have seen that a host’s support staff or a host’s control panel may place “php.ini” files in every subdirectory of WordPress’s core files. Typically, this is to change PHP settings throughout the site. Since this can generate a lot of scan results, we combine results for php.ini files into a single result with a note like “(238 more similar files were found.)”

If that occurs, we recommend checking the contents of some of these files to make sure they are safe. Assuming that they are safe, your host may have a better way to set the same PHP settings without adding additional files; depending on the server configuration, it is usually done through the PHPRC environment variable or by using.user.ini.

Alternatively, if you are sure they are safe, you can use the “ignore” option to hide the result unless there are future changes.

Let me know if this helps!

Thanks,

Mark

Hi @davidovic123, Thanks for reaching out.

To resolve the IP detection issue, find your public-facing IP address here – https://whatismyipaddress.com/. Then look at Wordfence > All Options > General Wordfence Options > How does Wordfence gets IPs and cycle through the options until it displays the IP address above. That will be the setting you need to use going forward, so click the Save button once you’re done.

Normally, the Server State and Vulnerability Scan warnings can be thrown by a number of factors, as each stage involves a few different checks. I can highlight those without trying to generalize too much: https://www.wordfence.com/help/scan/#scan-stages

As the page above explains, if there is an issue with any of those steps, then there’s a likelihood of the yellow warnings being shown. I might be able to help more specifically by seeing scan result messages and your server configuration if you send me a diagnostic report.

Can you send one to wftest@wordfence.com? You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated.

For the scan log, please navigate to Wordfence> Scan > Email Activity Log and send it to  wftest@wordfence.com as well. 

Let me know when you’ve sent both so I can have a look.

Thanks,

Mark.