Background of the issue:
I am receiving notifications from my hosting provider that some files in wp-content/languages are infected.
The files in question are /public_html/wp-content/languages/admin-es_ES.l10n.php and /public_html/wp-content/languages/admin-network-es_ES.l10n.php.
I have shared one of these files for review: hidden link.
I want to know if these are legitimate files from WPML or if they are indeed infected.
Symptoms:
Immunify is marking the file admin-es_ES.l10n.php as malicious.
Questions:
Are the files admin-es_ES.l10n.php and admin-network-es_ES.l10n.php legitimate files from WPML?
Are these files infected?
Thank you for contacting WPML support. While you wait for one of my colleagues to take this ticket and work on it, let me provide you with the first debugging steps or see if I can help with the issue quickly.
WPML is not adding those files. Those files, including the /wp-content/languages/ folder, are added by WordPress when a user sets his site to a language other than English. You will get the same folder and files if you set your site's language or admin language to Spanish or any other language for this matter. You can read more about it in the WordPress documentation here.