Newspaper theme old version hacked yesterday

Hi,

I was using old version of newspaper theme (Around 1 year old)

yesterday someone injected Malware in Header Ads code – traffictrade.life/scripts.js/

I tried removing it but it was again getting inserted. Then I uninstalled old theme and installed new version

Now that Malware is not appearing but I want to know whether newer version is malware safe or not? Is there any known bugs related to old version that says Malware can be injected in Newspaper theme?

The old version from prior to April 2016 had a security issue which was patched in 6.7.2 — and an issue with 7.0 fixed with 7.1. Similarly WordPress prior to 4.7 is insecure.

ALWAYS check the ‘changelog’ when new versions of themes, plugins, and WordPress core released to check for security issues.

If you don’t want to upgrade to v8 which is entirely new version and will require changes to site; you can email tagdiv (link bottom of page), to get 6.7.2, or 7.x, however they no longer provide tech support for 6x, so you’d be on your own if continuing to use it.

Bogdan,

I deleted Newspaper old version from my server and then I installed 8.1 version.

Is there still any possibility of malware?

When I deleted the old version of theme then I couldn’t see any Malware. Seems deleting of old theme fixed it. Could you please confirm.

Hi
I have the same problem. I’m not ready to upgrade the theme right now, can i just delete somehow this header ad block because i don’t use it for my ads?

Bogdan, on one of my websites i still use version 4.6.3 which has security issue. I’m going to upgrade to version 7 or 8 soon, but now i have this problem with malware in custom Javascript area.
I tried to delete panel_custom_javascript.php file, but it didn’t help, i still continue getting this malware in that area.
Could you give me an advise how can i disable this area and not to get any scripts there untill i upgrade the theme version?

This may help while waiting for reply from TagDiv on specific file to remove — however theme may not work with some edits:
https://forum.tagdiv.com/topic/tutorial-good-basic-security-practices/

One option if not ready to upgrade, after cleaning boxes and dbase
a) rename theme folder to something else (newspooper)
b) add function in the functions.php to remove versions/XMLRPC in the post data.

remove_action('wp_head', 'rsd_link');
remove_action('wp_head', 'wlwmanifest_link');
remove_action('wp_head', 'wp_generator');
add_filter('xmlrpc_enabled', '__return_false');

disable xml-rpc in your htaccess file (if using Apache hosting)
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
allow from 123.123.123.123
</Files>

Note – renaming theme folder will likely cause you to have to re-enable the theme from WordPress if you also rename the theme in the style sheet (the advanced method in addition to changing folder name). So, make sure you have backups of everything including all your settings from theme panel which you should already have backed up after cleaning.

The idea is
a) hide WP version
b) hide theme name by folder and style.css reading (style sheet is public, so ‘name’ is in there for bots to find)
c) perhaps even change the version in the style sheet to something like 44.6.66 vs 4.6.1 or whatever

so if your folder and style sheet say ‘newspooper’ vs ‘newspaper’ and different version number, and you block XMLRPC (known attack vector); you have a little bit of safety from bots ‘trolling the web’ for vulnerable versions.

In fact when I check my site running newsmag using this methodology, the “what theme are they using” site says “site not running wordpress…” — so a ‘win’ there.

Food for thought for those not wanting to upgrade. I can’t provide any other help than as noted, as I don’t work here — but ideas for those of you on older versions.

Thank you, Chris. I’ve renamed the theme already and will add the code you gave me.

For XMLRPC I actually use this in my htaccess file

<IfModule mod_alias.c>
RedirectMatch 403 /xmlrpc.php
</IfModule>