After several months of quietude, WordFence today started sending me this message:
* File appears to be malicious: …/zp-core/zp-extensions/viewer_size_image.php
I immediately downloaded the latest version of ZenPhoto and compared that file with the one on the server. They are identical.
Next steps?
-- Paul