What it is

A PHP file was found inside the uploads folder — a location meant only for images and attachments, never executable code. This is one of the most common ways an attacker hides a webshell (a backdoor that runs commands on the site).

How to fix it

Delete the file if you don't recognize it, and make sure PHP files can't be executed inside the uploads folder. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.

In depth

A PHP file has been found in your WordPress uploads folder, which is the directory where your images and documents should live. This is a serious problem because attackers often hide malicious files there to take control of your website, since most people don't expect to find executable code in that location. Someone either uploaded this file intentionally as an attack, or your site was compromised and the attacker placed it there. You need to delete this file immediately if you don't recognize it or didn't intentionally put it there yourself. After deleting it, you should prevent PHP files from ever being executed in that folder by adjusting your server settings, which stops this type of attack from working in the future. If you're not comfortable making these changes yourself, a security plugin can do this automatically for you, or you can ask your web hosting support team to disable PHP execution in the uploads folder. Check your uploads folder regularly going forward to make sure no suspicious files appear again.