Security: AWS (shared hosting) claims template file malicious

I found out enough information as to where these files came from, which for the moment is enough to satisfy me:
These were templates added by an update to a plugin (called Thrive) that handles janky website building atop WordPress.

After going through numerous sites I found that the templates were all slightly different with some being quite different; I suspect these are different sets of templates added by an update process (which was initiated at different dates/versions by some of the admins).

For whatever reason, this template file flew some kind of ‘malware’ flag on our hosting platform (WPEngine which uses AWS).

Here is an example of the one such templates (when searching for it on Google) found on another sorry website using Thrive: https://mon-salaire-en-slip.fr/wp-content/uploads/tcb_lp_templates/templates/

Related Posts:

  1. How to get WordPress to save upload file beyond web root [closed]
  2. Handling email piping attachments and detecting unsupported file types
  3. what is a auth_user_file.txt?
  4. How to view PHP on live site
  5. Is moving wp-config outside the web root really beneficial?
  6. Hide the fact a site is using WordPress?
  7. Verifying that I have fully removed a WordPress hack?
  8. Can I Prevent Enumeration of Usernames?
  9. Best way to eliminate xmlrpc.php?
  10. If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
  11. Should I remove install.php and install-helper.php?
  12. What is the difference between esc_html filter vs attribute_escape filter?
  13. How do I technically prove that WordPress is secure?
  14. Can upload doc and pdf but not ppt – not permitted for security reasons
  15. Which KSES should be used and when?
  16. Protecting direct access to PDF and ZIP unless user logged in (without plugin)
  17. How can I easily verify a core or plugin update has not broken anything?
  18. can not upload file .vtt on wordpress 5.0.1
  19. Disable comment windows for all existing posts (pages/blogposts)
  20. Generate WordPress salt
  21. Vanilla WordPress install, what can/should I put in disable_functions?
  22. Stop wordpress automatically escaping $_POST data
  23. Secure my “add_settings_field” translation?
  24. how can i embed wordpress backend in iframe
  25. Handling nonces for actions from guests to logged-in users
  26. WordPress Logout Only If User Click Logout or If User Delete Browser History
  27. Can I force a password change?
  28. What is pclzip.lib.php file that wordfence think it’s a malicious code
  29. How to disable XML-RPC from Linux command-line in a total way?
  30. How to remove javascript malware in wordpress site [closed]
  31. Completely remove the author url
  32. Securing my WordPress Files and Directories
  33. Restricting access to content
  34. About WordPress site security
  35. Single sign-on: wp_authenticate_user vs wp_authenticate
  36. How to allow internal links using wp_kses filtration
  37. How does Cross Site Scripting (XSS) work exactly? [closed]
  38. How does the “authentication unique keys and salts” feature work?
  39. vs WordPress Security
  40. esc_html__ security : what for in this example?
  41. Using HTACCESS for Secret Access
  42. wp-config.php being written by attacker
  43. Definitive wordpress directory ownership and permissions on linux
  44. XML-RPC errors they know my username?
  45. Is [admin / admin] acceptable for all local websites?
  46. Simple Online Payment for Event Registration [closed]
  47. What may be causing failure of auto-install features in WordPress (v3.0.3)?
  48. Client side HTTP parameter pollution (reflected)
  49. Local file inclusion critical security issue [closed]
  50. Malware script in database post table only? [closed]
  51. Best practices to assert current_user_can() with guests
  52. XMLRPC slow and weird websites/services
  53. How to implement secure frontend image upload? [closed]
  54. Are there security risks in working directly in the themes folder that builds into a theme folder?
  55. Is it safe to hand over the admin rights?
  56. How to find exploited wordpress plugin [closed]
  57. How I can open back door for myself?
  58. Basic password protection without using users and roles
  59. Does meta-data need to be sanitized?
  60. How can I force a specific password?
  61. Who updates the wp-admin/core file?
  62. How WordPress sanitizes post content on save? Or it doesn’t?
  63. Does this code indicate an exploit?
  64. Security issue with ‘paged’ and ‘posts_per_page’ parameters taken directly from a POST request?
  65. How to prevent to direct access of my custom plugin folder/files
  66. RESTRICT EDIT of PHP files?
  67. wp-content – permissions for files/folders created by apache
  68. How can I restrict access to specific parts of a page, not just the page itself?
  69. Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?
  70. User generated content and security
  71. HSTS header not being added correctly
  72. how to protect wordpress content from crawler
  73. Can WordPress admin user + database credentials be used to gain Cpanel or FTP access?
  74. Should I worry about SQL injection when using REST API?
  75. Links to root domain from search engines don’t work, but direct links and links from other referrers do
  76. How to Protect Uploads, if User is not Logged In?
  77. How can I backup my site if it gets hacked?
  78. How can I have more confidence that WP plugins aren’t getting and storing user data?
  79. Standard Method for Securing a WordPress Site
  80. wordpress security (only one part of the site)
  81. Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
  82. Any way to disable /wp-login.php redirecting to the site folder?
  83. Folder Permissions + Security Concerns
  84. Malware/Permission bug removal?
  85. Could a user account with a stolen password compromised entire WP site?
  86. Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users
  87. Secure a WordPress website in 2019: one plugin or a combinations of them?
  88. What are the different types of firewall protections available for a WordPress website?
  89. Run a security scan on WordPress site that has .htaccess password [closed]
  90. Is this a WordPress security bug?
  91. Competitor is somehow accessing MetaData on a hidden WordPress site
  92. WordPress Hacks/Defacing [closed]
  93. Directory to store secure file
  94. How can I give someone server access to only duplicate and modify a site?
  95. WP-JSON: Cross Origin Resource Sharing Vulnerability?
  96. How can I implement ansible with per-host passwords, securely?
  97. Why should I firewall servers?
  98. Does drilling a hole into a hard drive suffice to make its data unrecoverable?
  99. Can you alter the default wordpress strong password requirements?
  100. how to sanitizing $_POST with the correct way?