This is the technical support forum for WPML - the multilingual WordPress plugin.

Everyone can read, but only WPML clients can post here. WPML team is replying on the forum 6 days per week, 22 hours per day.

This topic contains 3 replies, has 2 voices.

Last updated by Bigul 4 months, 1 week ago.

Assigned support staff: Bigul.

Author Posts
May 31, 2019 at 3:51 pm #3931871

desireeC-2

We received a alert from hosting server that our website contains Webshell. After remove the possible dangerous files, we use WP cerber plugin to scan all the files and try to find out how the webshell appear. The plugin shows that there are over 100 cache files saved in wpml->twig folder.

URL looks like /uploads/cache/wpml/twig/a7/a7788dcf83d397b0ffbe6c631fd968ff06fdb09a4769f619aaaaab18bf0cf2e9.php

The format of file name similar like the webshell file we found.

Some are high risk with "Suspicious code found" message. Some are medium risk with "Executable code found".

We would like to know how to ensure all these files really created by WPML or hacker? Can we remove them ? If remove, any affect to the website?

May 31, 2019 at 6:21 pm #3932643

Bigul
Supporter

Languages: English (English )

Timezone: Asia/Kolkata (GMT+05:30)

Hello,

Welcome to the WPML support forum. I will do my best to help you to resolve these issues.

The uploads/cache/wpml/twig/ directory usually cache files that WPML uses to cache some pages/content, such as the language selector. Please check the following documentation for more details.

https://wpml.org/documentation/getting-started-guide/language-setup/designing-custom-language-switchers-using-template-files/#introduction-to-twig-templates-for-language-switchers

To clear the WPML Cache please try the following step. But please note that WPML will re-create the files again when you access the configuration pages and pages with the language selector on your site.

1) Go to WPML>>Support page

2) Click on Troubleshooting link (blue link in the middle of the page)

3) In Troubleshooting page, please click on the following option of the *Clean up* section. Then wait for confirmation of processing.

- Clear the cache in WPML

Now you are using the older version of WPML(4.0.3). Please upgrade to the latest version(4.2.6) after a full site backup.

--
Thanks!

Bigul

June 2, 2019 at 11:20 am #3937289

desireeC-2

Hi Bigul,

Thanks for reply.

If we clear the cache, is there any effect on the website like lost translation data?

June 3, 2019 at 3:05 pm #3943749

Bigul
Supporter

Languages: English (English )

Timezone: Asia/Kolkata (GMT+05:30)

Hello,

Thank you for the updates. These are cache files. So normally it will not affect the translation. But because of the version difference please do it after a site backup.

Have you upgrade to WPML 4.2.6, if not please do it after a backup.

--
Thanks!

Bigul

The topic ‘[Closed] Suspicious code found in the tiwg cache files created by WPML’ is closed to new replies.