Confirmed executable PHP backdoor in uploads

What it is

A PHP file in the uploads folder wasn't just found — it was confirmed to actually run when requested. Since uploads should only ever serve media, a PHP file that executes there is an active backdoor, not just a risk.

How to fix it

Delete the file immediately if you don't recognize it, and block PHP execution inside the uploads folder at the server level (most hosts support this with a simple .htaccess or nginx rule) — the WordPress Plugin's Security tab applies this automatically and also confirms whether the block actually worked on your server.