Virus Detected After Installing Woodmart Theme

Hello,

I have to say, I am quite disappointed that the only way to request support seems to be through this forum, despite having purchased the product. There doesn’t appear to be an option to contact support via email, and the contact form simply redirects to the forum, which is quite frustrating.

Now, to my issue: I recently purchased the Woodmart theme officially through Envato. The purchase code has been verified as correct according to the Xtemos website. However, since the installation, my antivirus software, my WordPress firewall, and my security scanner (three independent systems) have all flagged a virus, specifically in the theme.

There are now several folders containing identical encrypted files, filled with numbers and a bit of code, which suggests the code is obfuscated. These files are the same size and appeared only after the theme installation. The bigger issue is that I cannot delete these files, not even after removing the theme, as they seem to have deeply embedded themselves into the WordPress installation, possibly even into the database.

This is completely unacceptable! I expect a prompt and comprehensive solution from Xtemos, as this situation cannot continue. If no resolution is found, I will be forced to take further action.

Thank you for your help.

Best regards,

Hello,

Thank you for reaching out, and we apologize for the inconvenience you’re experiencing. It looks like the issue could be due to an infection that occurred on your website, rather than the WoodMart theme itself. We recommend downloading the theme directly from your ThemeForest account and checking if the theme files contain any infected or suspicious files.

Please ensure you are using the official, clean version from ThemeForest to avoid any issues with compromised files. Additionally, you may want to scan your WordPress installation and database with a reliable security plugin to ensure there are no lingering issues.

If the problem persists, feel free to update us with more details, and we will do our best to assist you further.

Best regards

Hi as already communicated. It is the theme. I can explain to you why I have come to this conclusion. I have completely reinstalled WordPress. So in a clean folder. I have deleted all the old files from the web server. So that nothing was left. I downloaded wordpress completely new from wordpress. I completely reinstalled the themes (except for WoodMart) and plugins via WordPress. I ran Wordfence, no result. Everything is great. I waited, new scan. Everything is great and clean. I installed WoodMart which I downloaded fresh from Theme Forest and activated it. Suddenly, shortly afterwards, Wordfence detected manipulated data and backdoors. So yes, I still think it’s the theme!

Hello,

Could you please send us a screenshot of the virus code and the file name so we can check it?

Kind Regards

[Author]

Posts