For those who missed the issue when it came up earlier this year, here is a refresher, since the topic has been in the news again this month.
HERE ARE THE FACTS AS I POSTED LAST AUGUST:
The version of the Themepunch Revolution Slider plugin which was first included with Newspaper “4” was “Version 4.3.8 SkyWood”; and Themepunch told me personally that the vulnerability only existed in version 4.1.4 and older/earlier (which is the version included with Newspaper “3”).
So, if you’re using Revolution Slider 4.1.4 or higher, or using Newspaper “4” you are fine. If you are still using Newspaper “3” you likely have the “bad” version of the plugin. Sadly, Themepunch did a poor job of making people aware of this issue.
Newsmag does not have the vulnerable version.
Also general rule of thumb and best practices is to REMOVE any plugins you ARE NOT USING from your WordPress install. They only bog down the system, and may prove to be an exploit later on if not secure to begin with.
Hmm.. I also read the news about it here, horrible 😀
http://marketblog.envato.com/news/affected-themes/
http://marketblog.envato.com/news/plugin-vulnerability/
http://thehackernews.com/2014/12/SoakSoak-Wordpress-Malware.html
Slight correction to how I wrote that — if you’re using versions NEWER than 4.14 then you are fine.
NEWSMAG users are fine.
(man I need a vacation …)
I use the newsmag theme. I updated via the themeforest automatic update plugin…when I just updated to the new version I do not see the revolution slider listed
Revolution Slider is an optional install. The zip version of plugin file, revslider.zip, is found in the main “all files” download from ThemeForest for NEWSMAG.
e.g., on your hard drive:
Newsmag-tf/plugins/revslider.zip
(or I guess technically on a PC: Newsmag-tf\plugins\revslider.zip )
From the “only install theme” file, it is found in
/Newsmag/includes/plugins/revslider.zip
The version of Revolution Slider included with NEWSMAG 1.3 is: Version 4.6.5 SkyWood (02nd December 2014)
