hack / security breach: creation of admin account

Good morning,
For several days, on one of my sites which has the Newsmag theme (Version: 5.2.3), I have regularly had an admin account which is created by itself with these identifiers:
Identifier: greeceman
Email: greeceman@mail.com

I’m analyzing and trying to understand what’s going on and I think it may be related to Newsmag / Newspaper themes.

By searching on Google inurl:author/greeceman (https://www.google.com/search?q=inurl:author/greeceman&sca_esv=564615981&rlz=1C1AVFC_enFR990FR990&sxsrf=AB5stBg-3D19dC6KHeEsXjO82wX6-rfxPg:169450 5341872&tbas=0&source=lnt&sa=X&ved =2ahUKEwjLluOnzKSBAxULTaQEHQ4VARQQpwV6BAgBEAs&biw=1920&bih=923&dpr=1) to see if other sites encountered the same problem, I saw that many WordPress also have this author and the common point is the Newsmag / Newspaper themes.

Could you give me your opinion and help me understand?

Thanks in advance

Good morning everyone,
we have the same problem on 4 sites that have the newspaper theme in common.

We analyzed everything and did tests with my outsourcing manager.

The process is as follows : as soon as an admin account connects to the WordPress backoffice, it creates the admin account
Identifier: greeceman
Email: greeceman@mail.com

If you identify yourself with an account that is not an administrator, the greeceman account is not created

thank you for your response but it’s Newsmag which is installed on my site, not Newspaper (cf : https://forum.tagdiv.com/topic/update-required-newspaper-12-1-1-brings-extra-security/)

• This reply was modified 2 years by jeromeweb.
• This reply was modified 2 years by jeromeweb.

Hi,

I have the same issue. I’m using the 12.2 version, so the security issue should have been fixed, right ?

Please let me know, a lot of websites are affected at the moment.

One of my sites (the one that uses tag div Newspaper theme) just experienced the same thing with an admin account being created with those same credentials:

admin account
Identifier: greeceman
Email: greeceman@mail.com

Even after deleting the account, within a few hours it returned and once again I deleted it. I also escalated to my WP Managed Host who ran a bunch of scans and tools to detect malware, which they could not find.

Just updated to the latest version of Newspaper—is this issue fixed? And is this a bug in the theme or something else? It seems quite a few users had this issue.

Thank you

I also have this problem. Every time I preview a post it creates the new admin account. I hired a malware removal service, but they couldn’t fix it. I “solved” it by not deleting greeceman from users but instead changing the role from “admin” to “none.” So now I at least no longer get new admin accounts when I preview a post.

I’m about to update my theme.

Oh, I tried that too! Changing the privileges to None seemed to work (or at least stop the constant new admin user additions)—but my host decided to try to delete it one last time after updating the theme to the latest version.

We’ll see—if it returns, I’ll do what you have done. But this is nonsense! I thought I was hacked and spent a lot of time trying to figure out how this greeceman got through all my security measures! What a lot of stress and time wasted.

I hope the staff at tag div responds, so we can truly know if this is a bug in newspaper/newsmag AND if it’s been solved.

My problem was apparently resolved by updating the Newsmag theme to the latest version.
Couldn’t update it automatically, I had to do it manually via FTP

ALWAYS UPDATE.

Then do a malware scan.

Look at the plugins you are using as well.

Updating worked for me, too. Hope I never see that name again, because that was scary.

The link you’ve posted doesn’t have any mention of checking the wp_options table. Are TagDiv going to release an update to actually fix the vulnerability in TD Composer?

Sucuri plugin identifies your problem. TagDiv Composer has a backdoor

I’ve been having a similar issue. This plugin called WP-Zexit kept getting installed and crashing my site. I’d delete it, and it would appear again a few minutes later crashing the site.

According to this reddit discussion (https://www.reddit.com/r/Wordpress/comments/16nlg60/comment/k1jmhju/), it’s related to a vulnerability with the TagDiv composer, so it’s related to your themes. I have Newsmag installed and I’ve updated to the latest version. I’ve also followed the steps on that thread, and as of last night, the attack seems to have stopped.

Please take a look into this and let us know what to do to prevent any potential attacks.

• This reply was modified 2 years by atena4ever.