I'm testing Wordfence a WordPress security plug-in on our site. It reports that /civicrm/civicrm/CRM/Case/BAO/Query.php contains suspected malware. Is this true? We are running CiviCRM 4.7.2.

Here's the Wordfence message:

Wordfence Scan Result


No, this is a false positive.

The line flagging this is:

$from .= " $side JOIN civicrm_option_value recent_activity_medium ON (case_activity.medium_id = recent_activity_medium.value AND option_group_activity_medium.id = recent_activity_medium.option_group_id ) ";

Suggested courses of action: 1. Get rid of Wordfence. 2. Tell Wordfence about this false positive and request they fix it.

  • 3
    Wordfence is a pretty decent and widely-used plugin for WordPress. A gentler course of action to suggest for George would have been to click "I have fixed this issue" link, and dismiss the notice. Mar 2 '16 at 19:33
  • Or that :) - Stack Exchange doesn't just let me type "Or that :)"
    – JohnFF
    Mar 2 '16 at 21:02
  • The false positives cleared themselves up with no action on my part. Maybe the first scan had a glitch and the later scan ran OK. Mar 12 '16 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.