Why did Jetpack (or another scanner) flag sss.php?
Because one optional feature in that file had the same shape as a well-known piece of WordPress malware. It was a false positive. The flagged code is the Override User Search feature, and it never created, changed or hid any user. The feature is rewritten with standard WordPress functions, so the pattern scanners look for is gone: update to 5.95.0 or later and scan again.
Available since 5.95.0.
What the scanner reported
Jetpack Scan flagged includes/sss.php as “a malicious code pattern known to add a backdoor that creates a hidden administrator account. This relies on database options for persistent access”. Other heuristic scanners can report the same file in similar words.
Why the code looked suspicious
A known family of malware hides an administrator account it has created. It hooks into WordPress’s user query, edits the raw SQL of that query to leave its own account out of the Users screen, and keeps the account’s ID in a database option so it survives.
The Override User Search feature hooked into the same user query and edited the same piece of SQL, and it checked a database option before running. Its purpose was the opposite: it added users to the wp-admin Users search, so an administrator could find a user by their user meta as well as by name and email. Scanners match the shape of code, not what it does, so the two looked alike.
Override User Search is off by default and only runs when ticked under Super Speedy Search > Back-end. It only ever acted on user searches in wp-admin. It never created users, changed roles or capabilities, or hid accounts from the Users list.
How the user search works
The user search uses WordPress’s own user query arguments. Super Speedy Search finds the matching users, then hands WordPress the list of user IDs and lets WordPress apply the role filter, pagination and totals as normal. Nothing edits the raw SQL of the user query, so the user-query hook and the SQL edit at the heart of the malware pattern are both absent.
A search on the Users screen with a role selected returns the matching users of that role, and the Quick Edit author list on a searched Posts screen lists only users who can be authors.
What to do if your site was flagged
- Update Super Speedy Search to 5.95.0 or later.
- Run the scan again on the updated files.
- Check Users in wp-admin, as you would after any security warning. The Override User Search feature never added accounts, so any user you do not recognise came from somewhere else and is worth investigating.
Further reading
Written for Super Speedy Search 5.95.0.
Comments