Find out which plugins your theme installed or carries inside it, and check each against its maker's latest version. Bundled plugins do not update with WordPress, so someone must watch them and update the theme.

Infected since the weekend

Since the weekend, malware called SoakSoak has been spreading through WordPress sites. Infected pages load harmful code into visitors' browsers, and Google has been showing warnings in place of many of them.

Being up to date with WordPress itself did not protect these sites. The way in was an old flaw in a slider plugin that came bundled with a large number of themes.

The plugin's maker fixed the flaw months ago. On many sites the fix never arrived, because a plugin that comes inside a theme does not update with the rest of the site.

A plugin the owner never chose

Premium themes often come with extra plugins: a slider, a page layout tool, a gallery. They are part of what the theme was sold on, and they install with it.

Some appear on the Plugins page like any other. Some sit inside the theme's own folder and never appear there, so the owner has no reason to know they exist.

Either way, the owner chose a theme, not a plugin. Nobody put the slider on a list of things to keep up to date.

Why the fix never arrived

WordPress offers updates for plugins listed in its own directory, and installs its own minor releases automatically. A premium plugin bundled in a theme usually gets neither.

A bundled copy is updated only when the theme's maker includes a new version in a theme update, and the site owner then installs that update.

Many owners never update a premium theme. The update may need a licence key nobody kept, or the theme was edited directly, so updating would wipe the changes.

So the flaw stayed open on sites whose owners had done everything WordPress asked of them.

Finding what a theme brought with it

Anyone responsible for a WordPress site can check this in under an hour:

Each bundled plugin then needs its version checked against its maker's latest. Where the theme's maker has released an update with the fix, updating the theme is the route.

What an infected site shows

Visitors using Chrome or Firefox may see a red warning page instead of the site, and search results can carry a line saying the site may harm their computer.

The owner often hears first from a customer, or from Webmaster Tools, which reports security issues it finds on verified sites.

Updating the plugin closes the door, but it does not undo what came through it. An infected site has changed files that need cleaning or replacing.

If the site is already infected

Restore the files from a backup made before the infection, or have them cleaned by someone who does this work. Then update the theme and every plugin before the site goes back up.

Change every password: the WordPress logins, the hosting account and the database. Flaws of this kind can expose the site's settings file, which holds the database password.

Once the site is clean, ask Google to review it through Webmaster Tools. The warning stays until Google has checked the site again.

A worked example

A cranberry farm in Pitt Meadows runs a farm store, harvest tours in October, and an online shop selling dried berries, juice and gift boxes, which is busiest in December.

Its WordPress site uses a premium theme bought two years ago. The home page slider of red berries floating in the bogs came with the theme, and nobody thought of it as a plugin.

On Monday morning the owner opened the site and met a red warning. The slider was the version from the theme's original package, never updated, because the theme had been edited directly.

Files were restored from a backup taken the previous Friday, and every password was changed. The edits went into a child theme, and the theme was updated with its maker's latest slider.

With the edits held in a child theme, each future theme update, and the slider inside it, can be installed without undoing them.

A review was requested in Webmaster Tools the same day. The farm's developer now checks the theme and its bundled plugins every month, alongside WordPress and the other plugins.

Who should be watching

Every plugin on a site, bundled or not, needs someone who watches for updates and security notices. On most small business sites, nobody has been given that job.

It can be the developer under a maintenance arrangement, the host if updates are part of the plan, or a named person in the business. What matters is that it is written down.

That person should know what the theme includes, check versions monthly, and act within days when a flaw like this one is in the news.

Keeping a theme updatable

A theme can only be updated safely if it was never edited directly. Changes belong in a child theme, which survives updates to the theme beneath it.

Keep the licence key and the account used to buy the theme with the site's other records, and test each update on a copy of the site after a fresh backup.

The counter-case

A site whose theme bundles nothing, such as a custom theme, has no hidden plugins of this kind. If its plugins all come from the directory, they update in the usual way.

Those sites still need someone watching. Directory plugins update only when someone clicks, or when automatic updates are set up and checked.

And this will not be the last flaw found in a bundled plugin. Every theme that comes with extras needs those extras on the list of things to update.

Checking what the theme installed

  1. Look at the site in Chrome for any warning.
  2. List every plugin, including those inside the theme.
  3. Compare each version with its maker's latest.
  4. Back up the site before changing anything.
  5. Move direct edits into a child theme.
  6. Update the theme and its bundled plugins.
  7. Name the person who watches for updates.

Step two brings the hidden plugins into view. A slider, gallery or layout tool nobody knew about is exactly the kind of plugin this attack went looking for.

To confirm that WordPress itself took last month's security release, see WordPress 4.0.1 and the sites that did not update.

Frequently asked questions

What is SoakSoak?

Malware reported over the weekend that infects WordPress sites through an old flaw in a slider plugin bundled with many themes. Infected pages load harmful code for visitors.

Why did the plugin not update itself?

Plugins bundled inside a theme are not updated from the WordPress directory. They change only when the theme's maker ships a new theme version and the owner installs it.

How do I find plugins my theme installed?

Check the Plugins page, the theme's folder and documentation, and compare the theme's version with its maker's latest. Whoever built the site should be able to list everything.

Is updating the plugin enough if the site is infected?

No. It closes the flaw but leaves changed files behind. Restore a clean backup or have the site cleaned, change every password, then ask Google for a review.

Why do owners avoid updating premium themes?

The update may need a licence key nobody kept, or the theme was edited directly, so updating would erase the changes. A child theme avoids that problem.

Who should watch for plugin updates?

Whoever is given the job in writing, such as the developer under a maintenance arrangement. That person should know what the theme includes and act within days on security news.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Theme bought years ago and never updated?

Give us access to the site, and we will list what the theme installed, check every version and plan safe updates.

Start a Conversation