Hello tagDiv team,
I’m contacting you regarding a serious security issue I’ve been investigating on a WordPress website using the tagDiv Composer plugin.
After noticing a large number of fake user registrations, I performed a full audit of the system, including blocking the REST API, disabling XML-RPC, and adding multiple CAPTCHA layers (Cloudflare Turnstile + image CAPTCHA).
Despite all these protections, fake users were still being created automatically.
🔍 Findings
After enabling detailed logging on the user_register hook, I discovered that all unauthorized user creations originate from this file:
/wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php
The log entries clearly show that the wp_insert_user() call (or an equivalent function) is being triggered from inside that file, even when public registration is disabled in WordPress.
I verified that:
The file path is valid and part of tagDiv Composer.
tagDiv Composer PLUGIN Version 5.4.1 | built on 29.04.2025 10:27
The site is running the latest version of tagDiv Composer and the Newspaper theme.
After reinstalling a fresh copy of the plugin, the issue still persists (which suggests either a persistent injection or an unprotected AJAX endpoint).
THX
RAINA
the fake users comes /wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php around line 1080
I backtraced teh registration call
Hi,
Thank you for taking the time to share all those with us.
I made a notice with those informations for our developers to check it and see if there is indeed a possible security vulnerability with that code.
Thank you!
Hi,
A task has been assigned to a developer, and it should be checked in a short time.
Thank you!
Hello, I updated to the latest version, 12.7.2, hoping that you had fixed the issue with fake user registrations in td_ajax.php.
I had patched the file myself to avoid the problem… but after the update, it started happening again.
Haven’t you included the fix I reported? That’s not very professional — this is a serious security issue and it should be addressed.
Hello,
We apologize for the inconvenience. I’ve looked into the issue, and it appears that while a developer was assigned to address it, the fix was unintentionally left out of the recent update likely omitted during the packaging process.
I’ve informed the development team, and they’ve confirmed they will review the issue and provide either an official or unofficial update as soon as possible.
Thank you for your patience and understanding.
Hi,
I forgot to ask if you have the tagDiv Opt-In Builder enabled, and whether the problem appears when this plugin is active or if it also happens without it.
Our developers have found something related to the Opt-In Builder plugin.
HI
I have no Opt-In Builder active or enabled
I re-comment the line 1080 in /wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php
and no more fake users
Hello,
I think I understand what the situation is in your case. I think you are using the registration option but you are using wordpress for this, with this option https://i.imgur.com/V1Jwk8O.png and the problem is that even though you are not using the theme option, fake users are created through the theme option, right? This happens because as long as the wordpress option for “Anyone can register” is active and the theme option for registration is active. To prevent the creation of fake users please set in the theme panel Social/Apis Google Recaptcha this is special for the theme option and will prevent the creation of fake users https://i.imgur.com/ulAdEVx.png
I use cloudflare as recaptcha i dont want to use google…
the problem that ajax end point is exposed .. for me its a bug you can force to use google recapchta ….
I apologize for this inconvenience,
I understand what you are saying and that for you that ajax end point is exposed is a bug, but unfortunately for the moment there are only 2 solutions, use google recaptcha or comment that line of code on each theme update.
I have sent a notification to the developers if they can also implement cloudflare as recaptcha for that ajax end point.
HI, I have the same issue, then I must deselect “Anyone can register” in setting general WordPress and then do a capcha with google? Or I can do a capcha and leave ON “Anyone can register”.
Thanks.
p.s.I agree with RAINA, the problem is in the Theme pls fix it 🙂
@bdp While they fix you can comment the line 1080 in /wp-content/plugins/td-composer/legacy/common/wp_booster/td_ajax.php
I understand the problem and the file associated with this plugin:
https://wordpress.org/plugins/notification-for-telegram/
It is a free tool to receive Telegram messages about real-time events happening on a WordPress site. There is also an option for Backtrace that captures the origin of every new user registration. The system now includes the file name and line number from which the registration was triggered, providing full traceability for debugging and security audits. This information is sent whenever a new user registers.
Have nice day
Rah
Hi bdp,
The default theme option for registration is enabled/disabled based on the WordPress option ” Anyone can register” – https://i.imgur.com/1pMNKyu.png. If this is disabled, the theme popup will no longer be possible to use. Now in case you use the register option, make sure that you also set the Google reCAPTCHA for the theme register (in the theme panel) – https://i.imgur.com/M3nGDUs.png
did you fix the issue in Version 12.7.3 – October 22nd, 2025 ??
At the moment, the only available option we have to address that particular issue is using Google recaptcha.
However, if you’re looking for an alternative, we recommend trying cloudflare Turnstile: https://www.cloudflare.com/application-services/products/turnstile/ (I understand you’ve already tried it, and normally it should do the job).
Thanks for your understanding!
so i will not updtae last Version 12.7.3
The 12.7.3 contains some fixes for Newspaper v12.7.2
– fix for TOC
– fix composer version for XSS vulnerability
– other various fixes;
If you do not need at least one of them, then there is no need to update to 12.7.3
https://tagdiv.com/newspaper-changelog/
HI
Version 12.7.4 – January 14th, 2026
will fix the problem above?
Hi,
You can review the recent updates in the changelog here:
https://themeforest.net/item/newspaper/5489609#item-description__autoupdate-system
The update includes several security and vulnerability fixes. However, I can’t confirm whether the specific issue mentioned in this thread has been explicitly addressed. Given that it appears to be a more targeted issue with a known workaround, it’s possible that it was not included in this update.
Thank you.
Hi team,
I’ve been reporting this issue since October 7, 2025 at 9:23 PM, and even after several recent updates, many users can still register by bypassing the CAPTCHA and other security measures. This leaves the door open to spammers, which is a real concern.
Could you please prioritize fixing it? I’ll hold off on the next update until it’s resolved. When it’s addressed, kindly update this thread to let us know—much appreciated!
Thanks so much, and have a great day!
Hi,
I made a new notice to our developers; unfortunately, this is all I can do.
What I can do is some suggestions for some plugins that can help, there are cases that are not covered by the recaptcha and those plugins can help:
https://wordpress.org/plugins/user-verification/
https://wordpress.org/plugins/user-spam-remover/
