I am running a current version of Wordpress using a custom Roots/Sage theme.

The other day in production, a full line of PHP containing move_uploaded_file was inserted to the top of lib/customizer.php which broke the production site until I removed the line.

I am the only developer with access and I don't believe I made this error on my own. The only plugin making use of move_uploaded_file is Contact form 7 and I can't see from looking into the code how it would insert a line into lib/customizer.php. I tried looking for code vulnerabilities but the offending code inserted doesn't seem too malicious and I can't find anything of interest.

I'm trying to figure out how to debug this error, or at least set myself up to figure it out if it occurs again. The host we are using, GoDaddy, does not have FTP logs and from what I can see Wordpress doesn't do any debug logging in production by default.

Any recommendations to help figure this out? Should I enable WP_DEBUG_LOG for the production instance?

  • 2
    Please include the full line that contained move_uploaded_file, as others can help by searching for a pattern matching this in other reports of attacks. – jaswrks Nov 6 '17 at 19:08
  • 1
    Enabling debug log won't necessarily be of help; what you really need is server access logs. I would check into those and see who touched the file where this code was added. That may give some insight. You may also want to add a security plugin for an added layer of insight and support. – WebElaine Nov 6 '17 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.