Wordfence warning about modified files

[Yan]

HivePress Favorites 1.2.2, Geolocation 1.3.7, Message 1.3.0, Reviews 1.3.0 have been modified from the file that is distributed by WordPress.org for this version… If you see a lot of changed files in a plugin that have been made by the author, then try uninstalling and reinstalling the plugin to force an upgrade. Doing this is a workaround for plugin authors who don’t manage their code correctly.

[andrii]

Hi,

Please provide more details on how long you have had Wordfence installed and if there have been any recent updates for this plugin. Also, is it specified which file is from the “file distributed by WordPress.org”?

[Yan]

I’m currently using wordfence 7.11.7 which was installed on hivepress 1.7.6 (got the warning since 1.7.7 or 1.7.8).

For more info > Scan Results - Wordfence

[andrii]

Hi,

Thank you for the report. Please let us know which files were modified and with what files (perhaps path, etc., are displayed).

[Yan]

1. plugins/hivepress-favorites/hivepress-favorites.php
2. plugins/hivepress-favorites/languages/hivepress-favorites.pot
3. plugins/hivepress-geolocation/assets/js/common.js
4. plugins/hivepress-geolocation/assets/js/common.min.js
5. plugins/hivepress-geolocation/includes/components/class-geolocation.php
6. plugins/hivepress-geolocation/languages/hivepress-geolocation.pot
7. plugins/hivepress-geolocation/vendor/autoload.php
8. plugins/hivepress-geolocation/vendor/composer/ClassLoader.php
9. plugins/hivepress-geolocation/vendor/composer/InstalledVersions.php
10. plugins/hivepress-geolocation/vendor/composer/autoload_real.php
11. plugins/hivepress-geolocation/vendor/composer/autoload_static.php
12. plugins/hivepress-geolocation/vendor/composer/installed.php
13. plugins/hivepress-messages/includes/controllers/class-message.php
14. plugins/hivepress-messages/languages/hivepress-messages.pot
15. plugins/hivepress-messages/vendor/autoload.php
16. plugins/hivepress-messages/vendor/composer/ClassLoader.php
17. plugins/hivepress-messages/vendor/composer/InstalledVersions.php
18. plugins/hivepress-messages/vendor/composer/autoload_real.php
19. plugins/hivepress-messages/vendor/composer/autoload_static.php
20. plugins/hivepress-messages/vendor/composer/installed.php
21. plugins/hivepress-reviews/assets/css/frontend.less
22. plugins/hivepress-reviews/assets/css/frontend.min.css
23. plugins/hivepress-reviews/languages/hivepress-reviews.pot
24. plugins/hivepress-reviews/templates/review/view/review-author.php
25. plugins/hivepress-reviews/templates/review/view/review-image.php
26. plugins/hivepress-reviews/vendor/autoload.php
27. plugins/hivepress-reviews/vendor/composer/ClassLoader.php
28. plugins/hivepress-reviews/vendor/composer/InstalledVersions.php
29. plugins/hivepress-reviews/vendor/composer/autoload_real.php
30. plugins/hivepress-reviews/vendor/composer/autoload_static.php
31. plugins/hivepress-reviews/vendor/composer/installed.php

[andrii]

Hi,

If I understand you correctly, these are files that have been modified? If Wordfence has clarified that it was not due to an update, but simply modified, then please check that your site has not been hacked, for example, through another way.

[Yan]

Hi, if i check HivePress Favorites 1.2.2, the file has indeed been slightly modified - definitely not by a hacker. To me, it looks 100% legit and I guess the warning can be ignored. Remains the question if you have to better manage code updates or not

Original File
----------------
18	add_filter( 	
19	   'hivepress/v1/extensions', 	
20	   function( $extensions ) { 	 
21	       $extensions[] = __DIR__; 	
22	 	 	 
23	       return $extensions; 	 	 
24	   } 	
25	); 

Modified version
-----------------
18	add_filter(
19	   'hivepress/v1/extensions',  
20	   function( $extensions ) {
21	       return array_merge( $extensions, [ __DIR__ ] );
22	   } 

[andrii]

Hi,

I see. Most likely, the Wordfence plugin shows warnings about each update from wordpress.org, we recommend checking the settings, there may be an option to disable these warnings.