In the PHP logs, I am seeing these errors being repeated approximately every hour during the day.
[20-Jun-2018 14:41:10 America/Regina] PHP Fatal error: Uncaught Error: Call to undefined function get_header() in E:\WPData\wp-spiritsd.ca\wp-includes\theme-compat\embed.php:13
thrown in E:\WPData\wp-spiritsd.ca\wp-includes\theme-compat\embed.php on line 13
In addition, I am seeing the requests in our IIS logs as coming from the webserver.
2018-06-20 20:41:10 W3SVC8 DMZ-WP1 10.182.196.120 GET /wp-includes/theme-compat/embed.php - 443 - 10.182.196.120 HTTP/1.1 WordPress/4.9.6;+https://www.spiritsd.ca - https://www.spiritsd.ca/wp-includes/theme-compat/embed.php http://www.spiritsd.ca 500 0 0 357 262 0
Inside our WordPress installation, only one file shows a reference to this path which is: \wp-content\plugins\wp-defender\app\module\hardener\component\hide-error-service.php. The embed.php file is referenced twice on line 29 and 37. I am not sure if this is causing the errors in our log files or not.