Theme Security Issue: Injections

Most of my websites that have woodmart theme have been facing injections lately. I updated them all and woodmart core, also reinstalled the theme and everything but when i open the website it still redirects me to some spam links.

When i change the theme the redirections/injections go away. How can i solve this asap because its causing me lots of damage?

Hello,

This bug has been already fixed in our theme. Make sure that you are running the latest version of the theme. Also, the WoodMart core plugin needs to be updated to the latest version 1.0.39 too. You can do this in WoodMart -> Plugins.

Kind Regards

Yes, as i already told you i have installed the latest updates two weeks ago including woodmart core 1.0.39 but today the injections appeared again.

In this case, your website is injected by something else, not the theme. This bug has been already fixed and confirmed by Patchstack who discovered it.

Kind Regards

When i change the theme the injections go away.

Do you mean that the malware injected goes away? In this case, you need to reinstall the theme first. Our original theme files are not injected. Probably, the theme was injected after you installed it on your website. It may be possible due to some vulnerability on your website.

Yes the malware goes away only when i change the theme, not even when i disable woodmart core or any other plugin. I downloaded a new theme from envato and reinstalled it but the problem persists. I think malware have lingered from the few weeks ago when the vulnerable version of woodmart core was active. Any suggestions on cleanup? I have reinstalled wordpress as well.

Could you please disable all external plugins that are not related to our theme and send us your admin access so we can check how it works? Also, reinstall the theme with the latest version downloaded from ThemeForest right after deactivating your plugins.

Kind Regards

Just FYI, i realized there has been a script injection in every html page possible: products, pages, 600+ media descriptions, size guides and everything possible there is. It took me few days to clean up the damages that woodmart core bug/vulnerability has caused, and not to mention the reputation of the website – which is a highly visited fashion store. Im very disappointed that you could let such things happen and also at least should be a system or something that you can send us emails informing when there is such a big vulnerability on your theme/plugins.

Hello,

Thank you for bringing up your concerns regarding the security of our software. We understand the importance of ensuring the safety and reliability of our products.

Indeed, like any software, security issues may arise from time to time. However, we want to assure you that we take security very seriously, and our team of experts works diligently to address any vulnerabilities that may be discovered.

In this specific case, we want to emphasize that we were proactive in responding to the potential vulnerability. We released an update containing a patch for the identified security issue well before it was publicly disclosed. This proactive approach ensured that our users were protected, and the update has been available for our customers for the past two months.

We highly encourage all our users to keep their software up to date to benefit from the latest security enhancements and features. If you have not done so already, we recommend installing the latest update to ensure the utmost security of your system.

Best regards

[Author]

Posts