A file appears to be malicious

What Wordfence found

The malware scanner read the file and matched it against Wordfence's signature set. The finding names the path and usually the signature that fired. This is a content match on the file itself, not an inference from its name or location.

Why it matters

A signature match means known-bad code is present on the server. Whatever put it there had write access, which means the entry route is still open until you find it. Treat the site as compromised rather than as having one bad file.

How to fix it

1. 1Do not simply delete the file and move on. Take a copy first if you need to investigate.
2. 2Look for how it arrived: check the vulnerability findings on the same site, and the file's modification time against your deploy history.
3. 3Restore affected paths from a known-clean backup taken before the modification date.
4. 4Rotate every administrator password, every application password, and the database credentials.
5. 5Regenerate the salts in wp-config.php to invalidate existing sessions.
6. 6Re-scan until clean, then scan again a day later — reinfection within 24 hours means the entry route is still open.

Findings that often appear with this one

• An unknown file was found in a WordPress core directory File change
• A known malicious file was found Malware
• The site is flagged by Google Safe Browsing Malware

How WPSecureOps treats it

The connector reports this as file. WPSecureOps files it under Malware and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.