possible compromised TD plugin?

One of my domains got suspended, it was the one using Newspaper theme. It has been restored after I removed the theme and plugins. I removed ALL files to start fresh. Some facts about me:

I update things in under 6 hours. if an update comes while I am sleeping hence 6 hours. No more than 24 hours.

I do not use any plugins that has no updates in 6 months or more. I use 2fa with my User account, Wordfence is used. My password is 25 mixed characters (lower and upper case, letters, numbers and symbols).
In everything else in my computer/digital life, I use a Yubikey and get notifications when there is a login.

Here is the original message I got from my hosting provider, for privacy’s sake I censored the domains:

Hello,

We have noticed trouble in the account with big CPU over usage in the account with monthly average value:
45.80% of 5.00% CPU Limit

and peaks over 65% recently seen in CPU Statistics menu:
https://(myloginidformydomainhosting.com)/statistics/load-stats/

In general, the more traffic and hits a PHP-based website gets the more CPU it consumes to process the scripts.
Additionally, high CPU usage is generated when a PHP-based website generates a high number of queries to its database:
https://(myloginidformydomainhosting.com)/mysql/stats/
https://(myloginidformydomainhosting.com)/statistics/web-stats/
https://(myloginidformydomainhosting.com)/statistics/traffic-stats/

Cross-reference of these factors and statistics will indicate to you which website generates the most CPU in the account.

In your case, this appears to be a combination of many websites running in the account starting with WordPress website at:
(mydomain.com)

which appears to be compromised by a hacker and running malicious scripts similar with its TagDiv plugins and Newspaper theme described in this article:
https://blog.sucuri.net/2023/10/balada-injector-targets-unpatched-tagdiv-plugin-newspaper-theme-wordpress-admins.html

and with huge amount of hits at:
(mydomain.com)/wp-json/tdw/save_css/

Due to these reasons, we have been forced to suspend the domain name, so it cannot be accessed online. Although this is so, you can access the domain name folder via File Manager or FTP to remove the trouble content.

The best solution in such a case is to download files to your computer for a comparison copy thus you can configure later needed plugins and templates as well as retrieve single static files like images.
Remove all files from the host(domain or subdomain) folder thus you can be sure that all malicious files are removed.
After that reinstall your website completely with a new fresh version of the scripts(core application, plugins, themes, etc.) latest versions. Use database configuration from wp-config.php file downloaded before so you can connect the reinstalled website to previous database for your website previous information.

Here is also a detailed article on a hacked website:
https://(myloginidformydomainhosting.com)/help/view-article/?id=550

Restore of the website files does not help in such cases as it reverts the same outdated scrips of your website which the hacker has compromised before so the trouble is repeated again and again.

Please check the content of your entire hosting account for any third-party scripts which are not a part of your websites uploaded by the hacker and remove such ones.
You have to change all passwords in your account too – all FTP accounts passwords and all scripts admin passwords.

After website is reinstalled you can try general protection of the WordPress script with a plugin such as one of these:

https://wordpress.org/plugins/better-wp-security/
https://wordpress.org/plugins/wordfence/

To optimize a website further:

– Try to reduce PHP/MySQL database requests with additional caching plugins like:

– WP Fastest Cache – https://wordpress.org/plugins/wp-fastest-cache/
or
– W3 Total Cache – https://wordpress.org/plugins/w3-total-cache/

– check details of the queries running – Query Monitor – https://wordpress.org/plugins/query-monitor/
and try to reduce queries or check with their developers for optimization advice.

– Try to reduce the number of articles that appear on your front page and reorganize them into sub-pages. This way you would lower the number of queries processed to the database on each visit of the website and will improve the site performance.

-check some advice to restrict bad bots crawling your website as they are a waste of website resources in general. Check online advice articles similar to:

https://onlinemediamasters.com/block-bad-bots-wordpress/#:~:text=To%20block%20bad%20bots%20in%20WordPress%2C%20use%20Wordfence’s%20live%20traffic,can%20slow%20down%20your%20website.

– Limit hits from Google bots from their system:
https://search.google.com/search-console/about

– check official WordPress documentation: https://wordpress.org/support/article/optimization/

Monitor the statistics mentioned above for at least a couple of days which should be enough to see if the changes made have enough effect or if you need to take further measures.

We will expect a solution of this trouble from you in 7 days and we may be forced to suspend the account after that if no updates are provided from you in this ticket.

Looking forward to hearing from you.

Best Regards,
(insert technician’s name here)

All my plugins,theme and WordPress are updated with 6 hours in average. Never more than 24 hours.

I did update to 12.6.5

I did the following:

1. Delete all files on the site
2. Delete the mysql database
3. Change my hosting account’s password
4. Change the admin e-mail’s password
5. Change the user e-mail’s password
6. Created a brand new mysqal database with a completely different 25 character password
7. Fresh download and install of Newspaper and the plugins, except the revslider or whatever it is called and the woo plugin as I don’t have a shop on it

I changed all passwords that I am missing to list there
None of the other plugins (non tagdiv plugins) are older than 6 months.

another reply from my host:

These are general details for optimization and security and a matter of development of the website which depends on you. You need to read carefully details what the trouble on that website was:
https://blog.sucuri.net/2023/10/balada-injector-targets-unpatched-tagdiv-plugin-newspaper-theme-wordpress-admins.html – and with huge amount of hits at: (insertmydomainhere dot com)/wp-json/tdw/save_css/

I still got issues after a fresh install of WordPress, Newspaper and the td-plugins
—————–
Hello,

Can you update us on any further progress you have made on the websites as we are still seeing a much higher CPU usage than the allowed limit for the account? The lack of updates and progress would lead to us suspending the account.

Best Regards,
—————–

Then I asked what file(s) were having the issue:

—————–
Hello,

Going off of our web statistics page
(the url stated here)/statistics/web-stats/
Using the “Webalizer” we see that the most hit page was this one.
/wp-json/tdw/save_css

Best Regards,
—————–

I censored the url

Did you try blocking access to:
/wp-json/tdw/save_css

same way you’d block access to anything else not public on the site, via root or folder htaccess
(I don’t work here.)

if the file is there, it must be for a reason. I can’t just block access. What would be the point of having it then?

Back to the CPU usage. I removed Newspaper and the TD plugins. Changed it to 2024. Just to test. the CPU usage went down.

So it has to be something on the theme or/and plugins. I didn’t use anything on the site. Just customize the settings then let it go as I had to fix another site.

It’s like leaving your car on your garage and taking public transit for a few days. The engine on the car shouldn’t be hot.

So blocking the save_css by putting their permissions to 000?

Then on the screenshot comment out that line with
<!-- and -->

Correct?

ignore my previous comment about permissions to 000

I tried commenting out the line and it gave me a critical error

// register ‘css-live’ extension
require_once “css-live/css-live.php”;

I tried the second line, both lines, for commenting out and critical error

I take that back….I noticed on the very top of the file /* and */

I think the critical error was because I was using <!– (code here) –>
When I used

/*
// register ‘css-live’ extension
require_once “css-live/css-live.php”;
*/

Then no critical errors. Apparently for HTML I use <!– (Code) –> and for PHP it is /* and */

I grew up doing HTML long time ago. Habit.

So

/*
// register ‘css-live’ extension
require_once “css-live/css-live.php”;
*/

Hello.
I also faced a similar problem. But the Newspaper version 9.1 has not been updated yet. Commenting in the code helped. Although after some time, the tagDiv composer plugin began to deactivate by itself. I was trying to figure out what the reason was and installed several monitor plugins. Including the REST API call monitor. And I found a huge mass of /wp-json/tdw/save_css requests. There were others, but there were very few of them in relation to the number of save_css requests. We don’t use plugins on our site that require a REST API, so through the firewall plugin I just blocked all REST API requests for non-logged in users. And in the REST API request monitor plugin, I see that a 401 response is now sent to such requests, instead of 200. At the same time, the opportunity to leave feedback via the Contact form 7 plugin has disappeared, since it is. But this is a temporary measure, and the REST API request block can be included in the code by compiling your own list of requests that should be blocked. And in the near future, we still plan to update the version of the theme. But the REST API block did not help with the problem of incomprehensible self-deactivation of the plugin. We will deal with this in another discussion thread.

Thanks) I will clarify some details for the update in a separate discussion.

Yes I commented out the line 163.

The usage is down: 42.56% of 5.00% CPU Limit (from originally 49%-53%, around that).