tablelands regional council

Thank you very much!

It is the autoptimize plugin; the only diff between the dev mirror and production is that w3tc and autoptimize are disabled (and no cloudfront). Turning off CSS and HTML optimisation in autoptimize on production cleared the issues.

Hi Shaon,

Accordion is used in that same page http://www.trc.qld.gov.au/document-library/ ; however, as it breaks we have disabled it. Basically, the page should use the following markup:

<h2>Latest Documents by Category:</h2>
[wpdm-accordion]
<h2>Search All Documents:</h2>
[wpdm-all-packages items_per_page="25" jstable=1]
<script type="text/javascript">// <![CDATA[
jQuery(function($){
        $('#wpdmmydls').DataTable().order( [ 2, 'desc' ] ).draw();
    });
// 

></script>

However, we have it just as :

<h2>Search All Documents:</h2>
[wpdm-all-packages items_per_page="25" jstable=1]
<script type="text/javascript">// <![CDATA[
jQuery(function($){
        $('#wpdmmydls').DataTable().order( [ 2, 'desc' ] ).draw();
    });
// 

></script>

Right now because the accordion short code breaks the entire page.

Confirmed, something is broken with accordion on our site since last update.

[wpdm-all-packages items_per_page="25" jstable=1 order_by="create_date" order="DESC"] is working fine; however, if we add [wpdm-accordion] first neither accordion nor all package render. With accordion left out all packages show.

Never mind, details about the exploit were found here: http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-download-manager.html

It is good to know exactly what the attackers did & we can now stop guessing now.

Constructive feedback:

• Include details of the exploits in the change log. This helps greatly when identifying attack vectors.
• Don’t use 2 different version numbering systems. I read the above security bulletin and ignored it because it didn’t correspond with the ‘Pro’ version numbering.