An unknown file was found in a WordPress core directory

What Wordfence found

Wordfence compares the contents of core directories against the official release for the installed version. This finding means a file is present that the distribution does not contain.

Why it matters

Nothing legitimate should add files to wp-admin or wp-includes. These directories are a favourite hiding place precisely because administrators rarely look there and the filenames can be made to look plausible. An unknown file here is one of the more reliable indicators of compromise in the whole scan.

How to fix it

1. 1Read the file before deleting it. A one-line PHP file with base64 or eval is not ambiguous.
2. 2Check the modification time and compare it against other findings on the same site.
3. 3Delete it, then reinstall WordPress core from the Updates screen to restore any legitimate file that was also altered.
4. 4Rotate credentials and regenerate salts, then re-scan.

Findings that often appear with this one

• A file appears to be malicious Malware
• A WordPress core file has been modified File change

How WPSecureOps treats it

The connector reports this as coreUnknown. WPSecureOps files it under File change and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.