Please have a look at the below page….it was displayed in modules but now it come a bunch of TagDiv code…any suggestion please?
https://www.parkbin.hk/0702/%e6%b8%af%e5%b3%b6%e5%8d%80%e5%8d%80%e6%b3%8a%e9%82%8a%e5%a5%bd/
[td_block_15 modules_on_row=”eyJhbGwiOiIzMy4zMzMzMzMzMyUiLCJwaG9uZSI6IjUwJSJ9″ limit=”” hide_audio=”yes” td_ajax_filter_type=”td_tag_slug_filter” ajax_pagination=”infinite” sort=”oldest_posts” image_alignment=”0″ image_height=”73″ show_cat=”none” show_author=”none” show_com=”none” show_excerpt=”none” show_btn=”none” category_id=”291″ tag_slug=”區區泊邊好” custom_title=”上環” td_ajax_filter_ids=”42, 43, 247″ td_filter_default_txt=”顯示全部” border_color=”#eeee22″][td_block_15 modules_on_row=”eyJhbGwiOiIzMy4zMzMzMzMzMyUiLCJwaG9uZSI6IjUwJSJ9″ limit=””……
need to activate td composer plugin
Hello @parkaka
I think that you have malware on the website. Please update to the latest version 12.6.6
If you want to update the theme, you should download the latest version of it from the Theme Forest account and download it.
I recommend that you update the theme manually https://forum.tagdiv.com/how-to-update-the-theme-2/ via FTP/cPanel/File Manager, also if possible disable extra plugins during the theme update to avoid any problems that may arise and make sure that you have activated the tagDiv Standard pack plugin to keep the website’s look. You can try to update the theme on a staging website.
After you update the theme, you need to update the theme plugins too.
In the worst cases, the settings in the theme panel may be lost (there have been isolated cases), in these cases, after the theme plugins that were previously used are activated, you will have to use a backup for the theme panel -> https://forum.tagdiv.com/import-export-theme-settings/
You could consider reinstalling the WordPress version, and checking for this plugin wp-zexit.php. It might be wise to inspect via FTP if it doesn’t appear in the WordPress -> Plugins. Additionally, using Wordfence to scan the website and remove unknown users would be prudent.
Change admin passwords and delete admin accounts you are not familiar with;
– Delete any weird/unknown plugins;
– Delete the weird/unknown themes;
– Clean unfamiliar Theme Panel injected code (example – https://i.imgur.com/4q70kCv.png);
– Clean WordPress files (example – https://i.imgur.com/stJCqiK.png)
Please block /wp-json/tdw/save_css
If an attacker wants to target this URL /wp-json/tdw/save_css they can do so. Even if the website uses a different theme, the attacker can still try that URL. We could add an option to be able to enable/disable the Live CSS, it will be considered. But for now in order to remove it this can only be done with a modification to the composer plugin. I think that all that removing it requires is to comment this line of code – https://prnt.sc/RtwvL5Nc4ikR -> https://prnt.sc/ymZmhdUfp57U But as I mentioned, the attacker can still try to access the URL.
Thank you!
