My host is reporting that there is malware on my site at public_html/wp-content/plugins/td-composer/legacy/common/common.php, and the malware is php.base64.decode
I have looked at the code in a fresh download of td_composer and it has the following:
/**
* return the decoded demo file settings
*/
add_filter( ‘td_demo_installer’, function( $file_path ) {
//read the settings file
return unserialize(base64_decode(file_get_contents($file_path, true)));
});
function tdc_b64_decode( $val ) {
return base64_decode( $val );
}
function tdc_b64_encode( $val ) {
return base64_encode( $val );
}
In it. Is this problematic, can I remove it ?
I now have this issueon ALL tagdiv newspaper sites. Urgent advice please…!
Hello,
The code you mentioned is not inherently malware, but some security tools may flag it as potentially risky. Specifically, the pattern unserialize(base64_decode(file_get_contents())) can be exploited if attackers gain control of $file_path. It is considered safe only when $file_path is fully trusted and properly validated otherwise, it could be abused.
If you can provide additional context or details about how this code is used, we’d be happy to review further.
Thank you!
It’s TagDiv code within the TD Composer plugin in the legacy/common.php file.
So i can’t advise how it is used as it is a TagDiv creation…
Can the file be updated to remove it, to satisfy my host ?
Hi,
What you can do is to comment or remove the code related to installing a demo – https://i.imgur.com/r9X5xFH.png, but the rest of the 2 functions can not be removed because the website will break.
Thank you!
