Jetpack Threats Detection Page Suggests Paid Malware Removal to WordPress.com Atomic Users

[ash1eygrace]

Quick summary

Navigating to Jetpack > Scan > and clicking the dropdown on alerts shares more details about the alert Jetpack detected, and recommends Codeable for help with resolving the threat. On WordPress.com Atomic sites, we include malware removal as part of hosting services.

Steps to reproduce

1. Start with an Atomic site.
2. Add the test.txt file from Eicar to the site and change it to a PHP extension.
3. Navigate to Jetpack > Scan or directly visit https://wordpress.com/scan/{sitename}
4. Scan the site
5. Click the drop-down to view more information about the malware alert.

What you expected to happen

Since malware removal is a benefit included with WordPress.com hosting, I expect the message to inform users that our team handles malware removal for them. Reference.

What actually happened

I see a recommendation for paid services through Codeable, with this message:

If you need more help to resolve this threat, we recommend Codeable, a trusted freelancer marketplace of highly vetted WordPress experts. They have identified a select group of security experts to help with these projects. Pricing ranges from $70-120/hour, and you can get a free estimate with no obligation to hire.

Impact

One

Available workarounds?

No and the platform is usable

If the above answer is "Yes...", outline the workaround.

Platform (Simple and/or Atomic)

Atomic

Logs or notes

More context here: p1729970443509609/1729934239.609379-slack-CEYCDRUL9

[nateweller]

Related: p7DVsv-lqP-p2