Got the following security risk alert from my host, WPEngine this morning.
At WP Engine we take security very seriously and make every effort to keep our customers aware of any potential issues. We are reaching out to you today because we identified your site(s) are utilizing the “Newspaper” premium theme.
We have been notified by Sucuri about a recent increase in exploits that specifically target outdated versions of this theme. They operate by injecting unwanted ads into the page’s links, directing visitors away from the intended site. You can read more about the specifics of the exploit here:
https://blog.sucuri.net/2017/06/unwanted-shorte-st-ads-in-unpatched-newspaper-theme.html
Due to the potential severity of this exploit, we strongly recommend that everyone using a version older than 6.7.2 update to the latest version. You can update this through the wp-admin dashboard, but if you have a customized version of the theme, you may want to consult with your developer to ensure your site does not encounter issues when updating. Please make sure to run a backup of your database first; which you can learn how to do here in an article: http://wpengine.com/support/restore/ or here in an interactive walkthrough: https://my.wpengine.com/dashboard/?walkthrough_id=2278
If your site does appear to be displaying the symptoms, the fix is quite easy to remove the exploited code. You will need to remove that code from the Newspaper theme panel’s “header ad” block in WordPress admin interface under Newspaper > Theme panel > ADS > YOUR HEADER AD. You can also replace it with your original ad code, and your site should return to normal. Be sure to update the theme in conjunction with making this change, as it will prevent any further compromises.
Yes, there is an oooold version of the theme which had a security issue, as did many themes; as did Visual Composer; as did WordPress core prior to 4.7; and that issue was fixed with very fast dot upgrade.
You need to review changelogs when new versions of any WordPress element is updated to ensure it’s been patched for any discovered security flaw.
Something like over 100,000 WordPress sites got hacked earlier this year for not updating WP core to new version with vulnerabilities patched. Also, old versions of PHP are no longer secure, either (e.g., 5.2 and 5.3 are end of life; 5.4 now end of life; 5.6 and up should be used).
For those of us on very customized older versions and can’t really upgrade without a lot of work, does anyone know what files/code to modify in order to patch this vulnerability. We don’t even use the ads function so I removed the code that displays them from the template, however that does not stop the code from getting injected in the header ads field in the DB. TIA.
This is very interesting information. This is exactly the issue I’ve been having with the Newspaper theme. Not happening on any of my other themes. I have version 6.7 on two different sites that continue to get hit. I actually sent a support ticket today about it, but have not heard back from the Newspaper support group. As you can see by the numerous support tickets in recent days, it’s not easy to upgrade to version 8 because of recent conflicts between Newspaper and Visual Composer. Newspaper wants you to start using TagDiv instead, but this forces you to rebuild all your pages.
I should have mentioned. You need to go to Theme Panel, then Ads, then Header Ad. There will be a section called Your Header Ad. The hacker will have installed the code in this box. You delete the code, and the problem with stop. However, the code will eventually reappear, and then you have to remove it again.
You can upgrade to the version 7.1x which is advisable if not wanting to go to 8x.
Also good to setup a security policy internally — you should be checking update changelog/readmes for *all* plugins/themes you use and for WordPress core — as the TagDiv theme security notice for 6.7x was included way back in April 2016:
Version 6.7.2 – April 27th, 2016
fix: social counter facebook issue with new API keys
fix: security issue
a minor issue with 7.0 was fixed with 7.1 for those early adopters who rushed to install 7.0
Version 7.1 – May 20th, 2016
fix: panel got stuck while saving in specific cases, mostly related to categories
fix: Related articles filter was not working with the settings from the panel if you choose related by tags and the post had no tags set.
fix: contributor users cannot change the post template now, this is more in line with WordPress
fix: Security issues
fix: back to top on ie9
fix: missing woocommerce add to cart on mobiles
==============
Everything on the web requires periodic checkups; it’s not static like old websites with static shtml files or similar. WordPress, plugins, PHP, MySQL, WooCommerce, etc., all need to be *checked* when updates are done — new features, no need to upgrade unless you read the help info first; for security patches, these should *always* be done when originally notified!
I don’t work here — but our ‘security practice policy’ internally forces us to CHECK when new updates come out to see WHY they were updated, in case of security issue(s).
Recommended you consider the same, or higher a company to do it for you.
For those of us on customized platforms, it’s not just simple to upgrade to the newest version. With our security policy, we usually only get hit when hacks use specifically whitelisted admin files such as admin-ajax.php which this hack does.
I’m not 100% certain as my change has been only live for a hour, but if you disable the td_ajax_update_panel action that the exploit uses, you can prevent the exploit from occurring. This is a stop-gap measure as this will also prevent you from updating any theme settings from the panel, so make sure you have them where you like them if you do this.
