Recently, our hosting platform (AWS) notified us of a malicious template file:
/wp-content/uploads/tcb_lp_templates/templates/tcb2-bright-content-page.tpl
On closer closer inspection, there are quite a few sites out there with this type of page/template, notably in the uploads folder, and looks to be a marketing type wank-page asking for subscriptions/email addresses.
Has anyone else seen this specific page making it through a form/plugin/other security hole? I know there are plenty of these types of exploits so apologies if this is too vague or generic.
Recently, our hosting platform (AWS) notified us of a malicious template file:
/wp-content/uploads/tcb_lp_templates/templates/tcb2-bright-content-page.tpl
On closer closer inspection, there are quite a few sites out there with this type of page/template, notably in the uploads folder, and looks to be a marketing type wank-page asking for subscriptions/email addresses.
Has anyone else seen this specific page making it through a form/plugin/other security hole? I know there are plenty of these types of exploits so apologies if this is too vague or generic.
I found out enough information as to where these files came from, which for the moment is enough to satisfy me:
These were templates added by an update to a plugin (called Thrive) that handles janky website building atop Wordpress.
After going through numerous sites I found that the templates were all slightly different with some being quite different; I suspect these are different sets of templates added by an update process (which was initiated at different dates/versions by some of the admins).
For whatever reason, this template file flew some kind of 'malware' flag on our hosting platform (WPEngine which uses AWS).
Here is an example of the one such templates (when searching for it on Google) found on another sorry website using Thrive: https://mon-salaire-en-slip.fr/wp-content/uploads/tcb_lp_templates/templates/
