Why WordPress 6.6.1 Was Flagged For Trojan Malware via @sejournal, @martinibuster

Multiple idiosyncratic reports person surfaced informing that the latest mentation of WordPress is triggering trojan alerts and astatine slightest 1 idiosyncratic reported that a web big locked down a website due to the fact that of the file. What truly happened turned into a learning experience.

Antivirus Flags Trojan In Official WordPress 6.6.1 Download

The archetypal study was filed successful the authoritative WordPress.org assistance forums wherever a idiosyncratic reported that the autochthonal antivirus successful Windows 11 (Windows Defender) flagged the WordPress zip record they had downloaded from WordPress contained a trojan.

This is the substance of the archetypal post:

“Windows Defender shows that the latest wordpress-6.6.1zip has Trojan:Win32/Phish!MSR microorganism erstwhile one effort downloading from the authoritative wp site

it shows the aforesaid microorganism notification erstwhile updating from wrong the WordPress dashboard of my site

Is this a mendacious positive?”

They besides posted screenshots of the trojan informing that listed the presumption arsenic “Quarantine failed” and that WordPress zip record of mentation 6.6.1 “is unsafe and executes commands from an attacker.”

Screenshot Of Windows Defender Warning

Someone other affirmed that they were besides having the aforesaid issue, noting that a drawstring of codification wrong 1 of the CSS files (style codification that governs the look of a website, including colors) was the culprit that was triggering the warning.

They posted:

“I americium experiencing the aforesaid issue. It seems to hap with the record \wp-includes\css\dist\block-library\style.min.css. It appears that a circumstantial drawstring successful the CSS record is being detected arsenic a Trojan virus. I would similar to let it, but I deliberation I should hold for an authoritative effect earlier doing so. Is determination anyone who tin supply an authoritative answer?”

Unexpected “Solution”

A mendacious affirmative is mostly a effect that tests arsenic affirmative erstwhile it’s not really a affirmative for immoderate is being tested for. WordPress users soon began to fishy that the Windows Defender trojan microorganism alert was a mendacious positive.

An authoritative WordPress GitHub ticket was filed wherever the origin was identified arsenic an insecure URL (http versus https) that’s referenced from wrong the CSS benignant sheet. A URL is not commonly considered a portion of a CSS record truthful that whitethorn beryllium wherefore Windows Defender flagged this circumstantial CSS record arsenic containing a trojan.

Here’s the portion wherever things went disconnected successful an unexpected direction. Someone opened another WordPress GitHub ticket to papers a projected hole for the insecure URL, which should person been the extremity of the communicative but it ended up starring to a find astir what was truly going on.

The insecure URL that needed fixing was this one:

So the idiosyncratic who opened the summons updated the record with a mentation that contained a nexus to the HTTPS mentation which should person been the extremity of the communicative but for a nuance that was overlooked.

The (‘insecure’) URL is not a nexus to a root of files (and truthful not insecure) but alternatively an identifier that defines the scope of the Scalable Vector Graphics (SVG) connection wrong XML.

So the occupation yet ended up not being astir thing incorrect with the codification successful WordPress 6.6.1 but alternatively an contented with Windows Defender that failed to decently place an “XML namespace” alternatively of mistakenly flagging it arsenic a URL linking to downloadable files.

Takeaway

The mendacious affirmative trojan record alert by Windows Defender and consequent treatment was a learning infinitesimal for galore radical (including myself!) astir a comparatively arcane spot of coding cognition regarding the XML namespace for SVG files.

Read the archetypal report:

Virus Issue :wordpress-6.6.1.zip shows a microorganism from windows defender