Search Results for 'update'

We have been affected by the same vulnerability and hopefully we managed to fix it (for now). Please release a security update asap.

Hello,
for everyone with this problem, you have to:
disable newspaper theme and delete the folder. Disable td composer and all plugins related to newspaper theme. Delete all.

Go to wp-content/plugins and search wp-zexit or wp-swamp.. delete folders

we will Install a fresh wordpress.. backup your wp-content folder to not lose your uploaded files, etc… backup wp-config.php, and any other file you find important inside your site folder. We will erase the folder. Backup your database.

Delete all files inside your site folder.

Download WordPress from wordpress . org/latest.zip , unzip it in the site folder. Please note that it will create a wordpress/ folder, and you need to copy all files to your root folder

restore your wp-config.php and wp-content folder that you have backed up

Now you have to check if your database is compromised, probably it is

on your wordpress database, check on wp_users if it have an user that is not created by you, probably with the name “greeceman”. Using command line code is ‘select * from wp_users;’

Delete user.. if the Id of the hacker user is for example 19, then use ‘delete from wp_users where ID=19;’ if you are using command line. Please don’t ever use SQL commands without the where clause.

Check if there’s something on ‘td_live_css_local_storage’ using ‘select option_value from wp_options where option_name = ‘td_live_css_local_storage’;’, probably is full of obfuscated sh1t.

Clear with ‘UPDATE wp_options SET option_value = ” WHERE option_name = ‘td_live_css_local_storage’;’

Hello,
I have two questions:
In accordance with your recommendation, I downloaded the latest version of Newspaper, updated and updated plugins, but my antivirus still warns me about JS/Agent.RAN. I was recommended by ESET NORT 32 to look for the “iz.fromCharCode” string that is associated with a malicious JS script, but I honestly don’t know how to do that, so please help.

Furthermore, you recommended me to use only one builder because of plugin conflicts. WP BAKEY VISUAL COMPOSER is much more friendly to me, but if I turn off TAG DIV COMPOSER, I get a message that it is needed for TAGDIV MOBILE THEME and TAGDIV STANDARD PACK, and my page “falls apart”, becomes unreadable.

Thank you in advance for your help, Dubravko

I’ve been having a similar issue. This plugin called WP-Zexit kept getting installed and crashing my site. I’d delete it, and it would appear again a few minutes later crashing the site.

According to this reddit discussion (https://www.reddit.com/r/Wordpress/comments/16nlg60/comment/k1jmhju/), it’s related to a vulnerability with the TagDiv composer, so it’s related to your themes. I have Newsmag installed and I’ve updated to the latest version. I’ve also followed the steps on that thread, and as of last night, the attack seems to have stopped.

Please take a look into this and let us know what to do to prevent any potential attacks.

• This reply was modified 2 years by atena4ever.

Any updates on this?

The problems started specifically after the update (12.6).
All the plugins seemed to be turned on.
The problem is, it seems like it is a mobile version but without the header logo.
https://photos.app.goo.gl/vzawRP7Cke9Mh9zg9
Yesterday it seemed to work again, but now it does not.

We Updated PHP to 8.1 at site ground, than updated Tag Div to 12.6 – worked for 3 days, then crashed all my mobile and desktop headers. that update is crap, let’s just call it what it is.
reverted back to the 12.5.1 update and now everything is working fine. you really need to patch the 12.6 update and re-release it after significant testing.
thanks
Kevin

Hi,

I’ve cleared all caches multiple times and nothing seems to work.

The problem only exists with the Social Counter. Everything else has been updated to the new X/Twitter icon properly.

Is there somewhere I can find/see the “X” icon to see what is there?

Regards

Mark

thank you.

We never found injection in the page. Only sucuri and bitdefender reported the hack, and after several days Imunify reported this file plugins/wp-zexit/wp-zexit.php

We saw that the wp-zexit module was installed automatically and an admin user created after deletion.

We updated the td-composer and it seems no more issue, but we see the edit error reported above. We will keep searching on your recommended list.

thanks

Hi @Bettina and @Anamaria ,

Could you kindly let us know when everything is resolved so we just have to make an update instead of adding custom code that we might forget to remove later?

Thanks

Actually, my mistake(!) I realized I’d upped the php on a different dev version (it has been awhile since we did updates on this site, because it’s continued to work flawlessly till now.) Have now made proper dev site php 8 and it is working. Thanks, CSintra, for updating, as it helped me clear this up.

• This reply was modified 2 years by michener.

Hi Bettina,
Perhaps I dont understand, but the issue is not the mobile functionallity.
And all plugins are updated to the correct versions (see the picture in my previous responses).
As I wrote, the typical edit page that we get editing a post, has been disappeared and instead I get the standard editor page, on which the Via and Source information is missing (with the group option etc). Therefore this information is missing as well on the final results page.
All pages that have been edited with the functionallity are showing the Source and Via buttons with referrals.

Hope you understand, sorry for the confusion.
@ https://cloudzeeland.nl I created with CSS a Source alike link under every page myself.

• This reply was modified 2 years by DocDigit.
• This reply was modified 2 years by DocDigit.
• This reply was modified 2 years by DocDigit.