[Claude Dagenais]

Here is the answer from Sucuri:

I inspected the card.php file specifically and there does not appear
to be any malware inside so I have restored it, the file was removed
as its a php file inside the uploads directory which should only
contain images, documents and other related files, not php files. I
apologize if this caused any problems.

So I would say this was a false positive but it raise the question of putting php in the upload directory. iTheme Security does not allow it either.
Claude