Suspicious function found

  • Resolved SiteVivid

    (@sitevivid)


    1 year, 1 month ago

    Hello. I imagine this is nothing but an over-protective security software, but I want to be sure. My security software is flagging two files for having suspicious code. It is WPGive Version 4.1.0 and the files are:

    /wp-content/plugins/eventprime-event-calendar-management/includes/lib/tcpdf_min/tcpdf_barcodes_1d.php

    /wp-content/plugins/give/vendor/tecnickcom/tcpdf/tcpdf_barcodes_1d.php

    The line of code in question in both files is identical. It is line 1070 and reads:
    $keys_a .= chr(0).chr(1).chr(2).chr(3).chr(4).chr(5).chr(6).chr(7).chr(8).chr(9);

    Can you confirm the legitimacy of these files and the line of code in question?

    Thank you in advance.

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Support Robin Joshua Del Mundo

    (@robindelmundo)

    1 year, 1 month ago

    Hi @sitevivid ,

    Glad you reached out. Happy to help!

    I’ve not heard of a host flagging that file before. I can assure you it’s a file that’s included in the plugin. Here’s a screenshot of my file path to it in my local site:

    That file, and the other tcpdf files, have to do with PDF file generation.

    If your site has been hacked, then I would definitely locate the source for that. Then, I’d back your site up and reload the GiveWP plugin.

    One idea would be to send them the URL to download the plugin from the WordPress repository and see if they can find what they think is the issue.

    Let me know if you have any further questions. Have a good day!

    Thread Starter SiteVivid

    (@sitevivid)

    1 year, 1 month ago

    Thank you Robin. As I mentioned, I’m sure it’s just an issue with the software. I’ve seen it tag other plugins that have that same line of code, “$keys_a .= chr(0).chr(1).chr(2).chr(3).chr(4).chr(5).chr(6).chr(7).chr(8).chr(9);”.

    Thanks for your update and I’ll reach out to the security software people and ask them.

    Christopher

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Suspicious function found’ is closed to new replies.