Avada 7.15.2 malware

luuk

Unfortunately CPfence didn't find this malware.
One of our websites with Avada 7.15.2 was compromised the website behaved like normal but some malicious code was added to the footer.

Avada patched the vulnerability in 7.15.4.

The compromised files where as followed.
Avada Theme function.php compromised
Added plugin Akismet with single file class.akismet-function.php (Hidden from plugin list)
Added mu-plugin avada.php (this can be different)
Added root file wp-config-ddev.php

Check the database for invisible users.

I can send the compromised files to the dev-team if needed.

cPFence

luuk

Yes, please send the files in a ticket and we’ll take a look.

Unfortunately, when a theme contains a severe vulnerability, attackers can use it to inject code that looks legitimate and stays under the radar of malware scanners. That’s why we strongly recommend using the Vulnerability Manager feature in cPFence to keep critical vulnerabilities off your servers.

Also, make sure Integrity Check is enabled and use the recommended settings below, as it’s very effective at detecting many types of malware infections and unauthorized file modifications.

cpfence --enable-integrity-check
cpfence --enable-auto-file-action
cpfence --set-check-frequency hourly