Yesterday I discovered my all updated but the theme (due to modal error) sites running Newspaper suffered an injection in head creating a new place holder tdw (tdw-css and such elements) calling to a news and suspicius js:
https://cdn.statisticscripts.com/stats/post.js
and the one of the other sites call to this:
https://one.dataofpages.com/sources/cdn.js
VirusTotal has a clear opinio about the file
https://www.virustotal.com/gui/url/1667b534f91bf126e5d2cef952bf96405dd51e1ff2bdaec05b2c377e44da3441?nocache=1
So I had to update urgently the theme to last version without testing if modal lightbox and classic editor is working again like in 12.3. I’ve not summarised what it could be affected and had to look everything when I have more time.
Any clue about this vulnerability? Are you aware?
Best regards
We have several websites hosted on the same AWS and protected by Cloudflare and Sucuri. All three websites are on the Newspaper theme.
One year ago, only these three sites got hacked. We got Sucuri to remove the malware – who pointed at that time to a potential theme issue.
Yesterday, we got hacked again – the same three sites running on the same theme.
Sucuri points again here (wp_options.option_value, option_name=td_live_css_local_storage)
We need someone to look into this – don’t hesitate to get in touch with us so we can provide you access to all three sites.
Hello!
This issue has been discussed already here: https://forum.tagdiv.com/topic/wp-zexit-malware-and-newspaper-theme-problem-please-see/
Thank you!
I have already emailed your colleagues asking for help.
Can I get an update on this, please?
Hi Guys, I’m using version 12.3 and have the following in my database.
Option Name
td_live_css_local_storage
Option Value
a:2:{i:0;s:0:””;s:3:”css”;s:125:”</style><span style=”position: absolute; left: -9655px;”>
I spotted this when trying to diagnose an issue with background ad spaces on my site where the hyperlink had stopped becoming clickable. I was looking through the source and spotted the following random code. This is near the top of the page.
<span style=”position: absolute;left: -9655px;display: none;”>
test
</span>
Should I be concerned?
Incidentally, I’ve deleted the complete Option Value (below) and my background ads have now started to work again.
The full option value was as follows.
a:2:{i:0;s:0:””;s:3:”css”;s:125:”</style><span style=”position: absolute; left: -9655px;”>
test
</span>
<div>”;}
Again, should I be concerned?
Hello @mattemkadia!
Please delete the code and update the theme and the plugins to the latest version.
Follow this guide to clean your WordPress and theme of malware: https://askwpgirl.com/10-steps-remove-malware-wordpress-site/
After that, you can update the theme to the latest update.
For every update, we always recommend the following:
-> First of all, please make sure you have a backup.
-> Please deactivate all the non-tested plugins with our theme before updating.
-> Update WordPress, PHP, the theme, and plugins to the latest version: https://forum.tagdiv.com/how-to-update-the-theme-2/.
-> Check all these requirements for the theme: https://forum.tagdiv.com/requirements-for-newspaper/
Thank you!
Is it also a short-term idea to delete the ‘td_live_css_local_storage’ row in the database entirely or does the vulnerability allow it to be created and populated?
Hello @mattemkadia!
You can delete it. After a refresh, when you enter the LIVE CSS option again and press the save button, the ‘td_live_css_local_storage’ will appear again, empty.
Thank you!
