Backdoor in td-composer allows anyone to append css code to the page by making a

All our sites have been infested with malware. https://www.bayareaparent.com/
found a backdoor in the live-css code that is part of td-composer in /wp-content/plugins/td-composer/css-live/includes/td_live_css_ajax.php that allows anyone to append css code to the page by making a POST request.

function td_live_css_on_rest_api_init() {
$namespace = ‘tdw’;
register_rest_route($namespace, ‘/save_css/’, array(
‘methods’ => ‘POST’,
‘callback’ => ‘td_live_css_on_ajax_save_css’,
‘permission_callback’ => ‘__return_true’,
));
}

Seems to be in all versions of theme. Version: 12.3, version: 11.3.2

css-live plugin.

• This topic was modified 2 years by lyon.
• This topic was modified 2 years by lyon.

live-css is a plugin used by td-composer that creates a backdoor for anyone to add malware. You need to fix your plugin.

function td_live_css_on_rest_api_init() {
$namespace = ‘tdw’;
register_rest_route($namespace, ‘/save_css/’, array(
‘methods’ => ‘POST’,
‘callback’ => ‘td_live_css_on_ajax_save_css’,
‘permission_callback’ => ‘__return_true’,
));
}
should be false

yes we all have this malware problem hmm!

is ‘permission_callback’ => ‘__return_true’, -> true to false…all we need to change or what !??

Hi,

I also experienced this. Can you let us know if there is already a fix for this?

Thanks