I think the Newspaper theme got hacked today….

Hi,

Today I visited my site to find an Ad pop-up was happening on just about every link I clicked, the following code was causing the problem:

<script type=”text/javascript”>
var adfly_id = 14654573;
var adfly_advert = ‘int’;
var popunder = true;
var exclude_domains = [‘example.com’, ‘MYSITEURL’];
</script>

This was found in the header of the site.

On further investigation as to where this code was injected, I found it in the Newspaper Theme settings for the headers ad:
Screenshot here – http://imgur.com/a/L55Dn

I’m not sure how the code was added, I don’t see any other activity or modifications other than that, I’ve since changed all my passwords.

I checked for recently modified files on the server and noticed a plugin “WordPress Maintenance Mode” seemed to have been modified. I have since disabled and deleted it, perhaps this was the way in, but I find it strange that the code was inserted in theme settings and not into an actual WordPress page like index.php

• This topic was modified 9 years by GadgetViper.

Thanks for the links Catalin, I’m definitely going to be taking additional steps. The reason I mentioned it here, is that the code was added to a theme setting, which made me think there might be a loophole in the theme itself.

Hi

The theme is tested many times and there are no security risks in it. Also envato double check each update and so far we didn’t had similar reports.
Theme’s settings are stored in database and when you view the panel the theme read them from there. Most likely on the site was a lack of security used to access directly the database and inject that code there. You can take a look in access_log file, there you may find more useful informations in this regard.

Thanks!