hi Anamaria,

Thanks for your response. It was indeed a coincidence. My hosting provider changed my .htaccess file for some reason and it has been reverted back. And it happened exactly at the same time when I updated the theme.

However the real problem is, why theme upgrade changed the htaccess file? As this can lead to security issues in future as well.

Hi, Thanks for the reply. I was also surprised how theme update can change the htaccess file but unfortunately it happened at same moment i updated with site with the lates theme. There was long list of blocked IPs but I don’t have all of them.

Hi,

I managed to block this page from Cloudflare. Some of the IPs are getting blocked which are trying to access this page. Surprisingly, few of them are passing for the same URI as I can see the hits.

https://hikinginsights.com/wp-json/tdw/save_css

80.82.78.133
/wp-json/tdw/save_css
2/20/24, 11:59 AM
226

Number of hits have increased now by the hacker, really appreciate your urgent support please. I have sent the details in email. Let me know if you need any further information please.

Hi,

Thanks for quick update. I have just sent an email now.

Now i clear the cache as homepage was screwed and its up now. Can you please take a look and advise if anything should be done urgently?

https://hikinginsights.com/

hi there,
Not sure what files to clean. My site was fine until couple of hours ago but it suddenly screwed as everything disappeared. Probably hackers did something? Below is the URL. Can you please urgently take a look and advise as its down?

https://hikinginsights.com/

Regarding wordfence, I don’t have that plugin license so I am not sure if that can help if i purchase it. Do you suggest any more changes like disabling more features/plugin etc please until IP blocking issue is resolved ?

Thanks for the update. I have been doing changes and checking the hits but unfortunately I am still getting the hits even though i blocked the URI (/wp-json/tdw/save_css
) from cloudflare as per the screenshot. I even tried different variation(like URI, URI path, full URI etc) to make sure i am not making any mistake but it did not help.

Also my hosting provider is still not able to figure it out why hackers IPs are not getting blocked. Surprisingly when I block my own IP, it works so its very strange.

I also made couple of more changes as per below blog post suggestion:

https://www.pluginvulnerabilities.com/2023/10/19/how-to-disable-access-to-exploitation-path-for-vulnerable-code-in-outdated-tagdiv-composer-plugin/

Hi there,
Thanks for the update. Yes i have the latest theme version (Newspaper Version: 12.6.4). Also i have disabled the live css by commenting the highlighted code.

Blocking Ip is also not working surprisingly for those IPs where he is hitting that service and I am checking that part with my hosting provider.
But since hacker is still hitting that page, can he do some damage to the site or sniff on any critical information like credentials etc?

Thanks for the response. I am using the default template. Please refer the below screenshot. I am afraid that if I change it, I will lost all the changes applied on the current default template. Is there anyway to modify this using composer or what are the option please?

https://hikinginsights.com/wp-content/uploads/2023/08/PostTemplate.jpg

That was it. Thank you for your support.

Thank you very much. It worked!!

Thanks for the update. Please confirm if such changes wont be lost on theme update from Themeforest?

Thanks for your response. I am not even able to find the single post comment option which you shared in your first screenshot.

Thank you for your help. This worked for me.

Hello,

Can you please let me know how to set that widget again? I tried to activate it but no luck. There is no option to activate it.

Hello

Thanks for the response. I took the below two screenshots, please have a look. Its showing inactive sidebar in second screenshot which is strange as I did not deactivated it. Please advise.

1)
http://awesomepkinfo.com/wp-content/uploads/2021/02/1_sidebar.jpg

2) http://awesomepkinfo.com/wp-content/uploads/2021/02/2_sidebar.jpg