My license.html file was injected by some gambling casino site. It only appears when I open the website via google. From the direct link, its still normal. But it still annoying to have my website got redirected to some casino website. I do delete the license file, and its disappear but not redirect back to my website (instead it show blank). My hosting provider was told me to ask help to the theme provider about this license.html file and maybe could gain the original file.
Here’s my website: https://lpmdinamika.co
The injected file: https://drive.google.com/file/d/1q9yYtZlQR_hzQq3G4POP7MeOhctQw4JX/view?usp=sharing
Hi,
I recommend you do a clean install of WordPress and the theme. Also, the file is license.txt, not with the extension HTML, so you can try to remane it or delete it. Additionally, please check all the files for the strange code.
Additionally, using Wordfence to scan the website and remove unknown users would be prudent.
Change admin passwords and delete admin accounts you are not familiar with;
– Delete any weird/unknown plugins;
– Delete the weird/unknown themes;
– Clean unfamiliar Theme Panel injected code (example – https://i.imgur.com/4q70kCv.png);
– Clean WordPress files (example – https://i.imgur.com/stJCqiK.png)
Please block /wp-json/tdw/save_css
If an attacker wants to target this URL /wp-json/tdw/save_css they can do so. Even if the website uses a different theme, the attacker can still try that URL. We could add an option to be able to enable/disable the Live CSS, it will be considered. But for now in order to remove it this can only be done with a modification to the composer plugin. I think that all that removing it requires is to comment this line of code – https://prnt.sc/RtwvL5Nc4ikR -> https://prnt.sc/ymZmhdUfp57U But as I mentioned, the attacker can still try to access the URL.
Thank you!
