Attempt to upload malicious file denied Suspicious SQL code detected

Bug Reports
1

Attempt to upload malicious file denied Suspicious SQL code detected… traffic inspector blocking a product that has multi options to the cart, meaning the product is not added to the cart
ype E_WARNING (2)
info file_get_contents(/tmp/phptnkdu9r5t90f7sbPB2d): Failed to open stream: No such file or directory
file wp-admin/includes/class-wp-filesystem-direct.php
line 39
source WordPress
3

WP Cerber blocked this request because it contained what looks like SQL code. It could just be a false positive, but it’s better to be safe.

This usually happens for one of two reasons, one is a false positive and another is not:

  • A product plugin generated a weirdly formatted request that resembles backend SQL code.
  • Someone is actively probing the extension for vulnerabilities.

A properly designed WooCommerce extension should only send standard data (like product IDs or option values), never SQL fragments.

This PHP warning gives us more context: a piece of code tried to read a temporary file from the global /tmp directory. WordPress is only reporting the failed operation.

Reading files directly from global /tmp is definitely not normal behavior for a well-designed WooCommerce extension and often points to insecure coding. This could be a poorly coded feature failing to clean up after itself, or an attempt to exploit a file inclusion (LFI) path that Traffic Inspector interrupted.