Search Results for 'composer'

tagDiv Composer 5.4.4. unauthenticated user enumeration & AJAX vulnerability

Our site (running tagDiv Composer 5.4.4) was hit (STILL IS) with over 160,000 requests in less than 24 hours.

The attacker used the admin-ajax.php endpoint with Newspaper theme actions to trigger password reset triggers for the username teryaljw.teryaljw.

The bot is sending POST requests to: admin-ajax.php?td_theme_name=Newspaper&v=12.7.5

Even with “Anyone can register” set to OFF, the theme’s AJAX handler for user functions allows unauthenticated triggers of the WordPress wp_mail function via lostpassword_post. This allows the site to be used as a “spam relay” and causes massive server load.

In comparison, standard WordPress core blocks these attempts at the login screen while the Newspaper AJAX handler is bypassing these core protections.

Please implement Nonce Validation and Unauthenticated Request Filtering for all td_ajax_ account functions.

Hello tagDiv Support,

I need help with a serious issue that started after updating Newspaper. I have spent hours troubleshooting this and I want to give you a clear, detailed summary so you can understand exactly what is happening.

My site:
MarryCaribbean.com

Theme:
Newspaper

Problem summary:
After the update, my single post pages began crashing and showing the WordPress critical error message. At the same time, several layout behaviors changed unexpectedly, including my post hero styling and category/archive display.

Here is what I observed and tested.

1. Single posts started failing after the Newspaper update

Before the update, my single posts were working normally.

After the update:

* Single post pages began showing “There has been a critical error on this website.”
* This was happening under Newspaper, while the site worked under a default WordPress theme.
* Category pages and other parts of the site were not failing in the same way at first, which made this look specific to the Newspaper single post rendering path.

2. Debugging pointed to td-composer

I enabled WordPress debug logging and found fatal errors pointing to td-composer, specifically memory exhaustion in this path:

/wp-content/plugins/td-composer/legacy/common/wp_booster/td_util.php

I also saw repeated notices for translation loading from other plugins, but those did not appear to be the main cause of the front-end post failure.

The key fatal I saw was memory exhaustion inside td-composer.

3. Default WordPress theme worked

To isolate the issue, I temporarily switched to a default WordPress theme.

Result:

* The single posts loaded
* The content itself was fine
* This suggested the problem was not with WordPress core or the post content itself, but with Newspaper/tagDiv rendering

4. Backup restore did not solve the issue

I restored a backup using UpdraftPlus, including:

Database
Plugins
Themes

However, this did not restore the previous Newspaper behavior on its own. The single post issue remained. What actually made individual posts load again was manually opening them and explicitly selecting a post template such as FROM PANEL or DEFAULT and then updating the post.

5. tagDiv Composer / Cloud Library behavior was inconsistent

After the restore:

* tagDiv Composer and tagDiv Cloud Library had to be reactivated
* Header/footer/custom appearance behavior changed depending on whether these plugins were active
* At one stage, single posts worked with Composer off, but the custom header/footer/design was degraded
* With Composer on, other design pieces came back, but single post behavior was still unstable or altered

6. The biggest discovery: post template behavior changed

This appears to be the most important clue.

I found that many posts would work again only after I manually opened the post and explicitly selected a post template, for example:

* FROM PANEL
or
* DEFAULT

If I manually selected one of those and updated the post, the post would usually load again.

This strongly suggests the update changed or broke how post template settings were being inherited or interpreted.

What is especially concerning is that this appears to affect many posts, not just one or two.

7. “From Panel” is not consistently broken, but behavior changed

I originally thought FROM PANEL itself was broken, but after more testing I found:

* Some posts work on FROM PANEL
* Some posts work on DEFAULT
* Some posts needed to be manually touched and saved before they would work at all

So the issue does not seem to be as simple as “FROM PANEL is broken.”
It feels more like the update disrupted how template/layout assignments are being inherited or loaded on a per-post basis.

8. My hero/header layout on single posts changed

Even after I got the posts loading again, the visual layout is not what it was before.

Before:

* My post hero had a stronger designed look
* The title, author, tags, and hero image styling appeared more integrated/overlaid
* There was more of a styled hero presentation

Now:

* The posts may load, but the hero/header presentation is simplified or degraded
* The featured image sits more plainly
* The old styled hero treatment appears to be missing

So even when the post works, the layout is not the same as before the update.

9. Article Display View options appear to be missing

In the Theme Panel, under areas where I remember having many layout/style choices, the “Article Display View” area appears blank or missing its usual options.

I specifically remember having many appearance/layout choices there before. Now those options do not appear to load properly.

This makes me think some template/module UI in Newspaper is no longer loading correctly after the update.

10. Category/archive behavior also changed

After the update:

* My category/archive sections changed layout
* I had 3 items per row before, but now it is showing 2
* I also started seeing little comment count boxes with “0”, which I never wanted and did not have before

I checked Block Settings and global module meta settings. Show Comment Count appears to be off globally, but the archive/category output is still not matching what I had before.

This makes it seem like the archive/module style or template behavior changed during the update as well.

11. Cloud Templates screen appears empty

In Cloud Templates, I currently do not see cloud templates assigned in the way I expected. For example, the Single Templates area appears empty.

That is confusing because I know my site had a more customized appearance before, and the current theme behavior no longer matches it.

12. Main concern

My biggest concern is that this update appears to have:

* broken or altered post template inheritance
* changed single post rendering behavior
* removed or failed to load layout options I previously had
* changed archive/category display unexpectedly

On a larger site, this kind of behavior is extremely disruptive because it can force manual repair of many posts.

What I need from you:

1. Help identifying exactly what changed in Newspaper that caused single post template behavior to break or stop inheriting correctly
2. Help restoring the original post hero/layout behavior I had before the update
3. Help restoring the archive/category display so it matches the previous layout
4. Help understanding why the Article Display View choices appear missing/blank
5. Guidance on whether this is a known issue in the current version and whether there is a patch or recommended fix

I would appreciate a serious look at this, because this has taken a lot of time to troubleshoot and it clearly appears connected to the Newspaper/tagDiv update path rather than WordPress itself.

Thank you,
MarryCaribbean.com

Hello, I purchased a license for the NewsPaper theme from you. I’d like to make some major changes to my site, which I currently have duplicated locally. However, I can’t access TagDiv Composer. Can you help me? Thanks.