Core verify-checksums command doesn't catch added files at ABSPATH directory about checksum-command HOT 3 CLOSED

I believe that this is actually a feature, not a bug. wp core verify-checksums will verify the checksum of the WordPress-related files in the root directory, but does not check for the addition of new files in the root directory. This is because you could (and very likely do) have other non-WordPress related files in the root directory of your site, which cannot be verified.

So, having a robots.txt or an /images/ folder or some other unrelated PHP script in the root directory of the site is fine; we just want to be sure that none of the WordPress scripts in the root directory have been modified. But, having some files hidden in wp-includes is bad, as there should not be anything in that directory which isn't WordPress-related.

If we were to start alerting on unexpected files in the root directory, then it would just lead to tons of false positives which would not be ideal.

I think the tool, as it is now, does it's job of making sure that none of WordPress'es core files have been modified, and that nothing else is trying to be included in an area where most webmasters wouldn't look/wouldn't know if it was really created by WordPress or not.

from checksum-command.

Thanks for reply @jasongill.
I agree to your opinion. But at the same time, I think it would be nice to have two options like ‘—include-root’ and ‘—exclude’ to keep current usage safe for current users and provide functions to keep root to be safe too.

For the users who want to keep them root directory safly, they would able to use ‘ wp core verify-checksums —include-root —exclude=images’.

from checksum-command.

I agree 100% with @timoshka-lab. I have come across multiple instance of malware dumping files in the root directory.

from checksum-command.