Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on /w3-total-cache/lib/W3/Cache/File.php

enter image description here

should I be worried? Last time I read there is a W3 exploit going around.

share|improve this question
1  
Had you manually compared the files to the version of plugin you are using? I am not sure where "original" plugin files are coming from for that scan. At least some of this seems related to recent plugin updates plugins.trac.wordpress.org/changeset/645436 –  Rarst Jan 19 '13 at 12:42

2 Answers 2

up vote 1 down vote accepted

That security hole in W3 Total Cache was associated with data leaking through an exploit, and not explicitly with hackers changing code (that could happen afterwards, of course, but what you show isn't this). The exploit has been fixed so just make sure your plugin is up to date. If unsure, disable / delete the plugin, then reinstall afresh from the plugin repository.

That isn't to say that you haven't been hacked, of course. Look for other signs, like core files with dates different to neighbouring files, folders that shouldn't be there, etc. Have a read of the hacked FAQ on wordpress.org for starters.

share|improve this answer

No one can give a "no" as an answer without inspecting your installation, but many times security breach will manifest in theme files and not plugin files (if at all, sometimes the hackers just want to place and serve malware from your server without affecting your site).

When a plugin has an exploit it doesn't directly follow that its code can be changed, so even if your W3CT files were changed it doesn't follow that it is because of an exploit in that plugin. If there is an exploit it might be in another plugin, in the server, or in the admin's computer.

share|improve this answer
    
I've seen plugin files hacked, but they are generally total file replacements (leading to plugin failures), not subtle code changes as above. –  webaware Jan 19 '13 at 22:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.