What it is

A PHP file in the uploads folder wasn't just found — it was confirmed to actually run when requested. Since uploads should only ever serve media, a PHP file that executes there is an active backdoor, not just a risk.

How to fix it

Delete the file immediately if you don't recognize it, and block PHP execution inside the uploads folder at the server level (most hosts support this with a simple .htaccess or nginx rule) — the WordPress Plugin's Security tab applies this automatically and also confirms whether the block actually worked on your server.

In depth

Your WordPress site has a malicious file hidden in your uploads folder that an attacker can run to take control of your site. This file should never exist because the uploads folder is only meant to store images and documents, not executable code. When someone requests this file through their browser, it runs commands on your server, giving the attacker a way to steal data, modify your site, install more malware, or send spam from your domain. You need to immediately delete this file, and then prevent your server from ever running PHP files from the uploads folder again. Your web host can do this through something called .htaccess or an nginx rule, which is essentially telling your server "these files should never be allowed to run." Most security plugins including WordPress's own security tools can apply this protection automatically, and they'll verify it worked so you know your site is actually protected.