{"id":292446,"date":"2026-03-26T10:53:03","date_gmt":"2026-03-26T10:53:03","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/balada-fix\/"},"modified":"2026-03-26T11:00:48","modified_gmt":"2026-03-26T11:00:48","slug":"balada-fix","status":"publish","type":"plugin","link":"https:\/\/bal.wordpress.org\/plugins\/balada-fix\/","author":23469591,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_crdt_document":"","version":"1.1.0","stable_tag":"1.1.0","tested":"6.9.4","requires":"5.0","requires_php":"7.2","requires_plugins":null,"header_name":"Balada Fix","header_author":"365dizajn","header_description":"Blocks unauthenticated POST requests to vulnerable REST paths (e.g. wp-json\/tdw\/save_css). Add paths in Settings \u2192 Balada Fix. Only logged-in users with edit_theme_options can access listed paths.","assets_banners_color":"","last_updated":"2026-03-26 11:00:48","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/365dizajn.com","rating":5,"author_block_rating":0,"active_installs":0,"downloads":64,"num_ratings":1,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.1.0":{"tag":"1.1.0","author":"vladanrs","date":"2026-03-26 11:00:48"}},"upgrade_notice":{"1.1.0":"<p>You can now add and edit blocked paths in Settings \u2192 Balada Fix (one per line).<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3491702,"resolution":"128x128","location":"assets","locale":""},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3491702,"resolution":"256x256","location":"assets","locale":""}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.1.0"],"block_files":[],"assets_screenshots":{"screenshot-1.JPG":{"filename":"screenshot-1.JPG","revision":3491702,"resolution":"1","location":"assets","locale":""}},"screenshots":{"1":"Screenshot installed plugin"},"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[258673,144339,23853,600,38850],"plugin_category":[54],"plugin_contributors":[],"plugin_business_model":[],"class_list":["post-292446","plugin","type-plugin","status-publish","hentry","plugin_tags-balada","plugin_tags-injector","plugin_tags-rest-api","plugin_tags-security","plugin_tags-wp-json","plugin_category-security-and-spam-protection","plugin_committers-vladanrs"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/balada-fix\/assets\/icon-128x128.png?rev=3491702","icon_2x":"https:\/\/ps.w.org\/balada-fix\/assets\/icon-256x256.png?rev=3491702","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/balada-fix\/assets\/screenshot-1.JPG?rev=3491702","caption":"Screenshot installed plugin"}],"raw_content":"<!--section=description-->\n<p>Balada Fix protects your site from unauthenticated abuse of specific WordPress REST API endpoints. Such endpoints (for example the tagDiv theme's <code>wp-json\/tdw\/save_css<\/code>) are often targeted by the \"Balada Injector\" and similar campaigns to inject malicious scripts.<\/p>\n\n<ul>\n<li>Add one or more REST path patterns in <strong>Settings \u2192 Balada Fix<\/strong> (one per line).<\/li>\n<li>Only logged-in administrators with the <code>edit_theme_options<\/code> capability can access those paths.<\/li>\n<li>Unauthenticated or unauthorized requests receive a 403 Forbidden response.<\/li>\n<\/ul>\n\n<p>Default protected path: <code>tdw\/save_css<\/code> (tagDiv \/ Newspaper theme vulnerability).<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin files to <code>\/wp-content\/plugins\/balada-fix\/<\/code>, or install through WordPress Plugins \u2192 Add New \u2192 Upload.<\/li>\n<li>Activate the plugin through the Plugins screen.<\/li>\n<li>Go to Settings \u2192 Balada Fix to review or add blocked paths (one per line, e.g. <code>wp-json\/tdw\/save_css<\/code> or <code>tdw\/save_css<\/code>).<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"which%20paths%20should%20i%20add%3F\"><h3>Which paths should I add?<\/h3><\/dt>\n<dd><p>Add the REST path that is known to be vulnerable and should only be used by admins. Example: <code>tdw\/save_css<\/code> for the tagDiv Composer \/ Newspaper theme. You can use the full path like <code>wp-json\/tdw\/save_css<\/code> or the short form <code>tdw\/save_css<\/code>.<\/p><\/dd>\n<dt id=\"will%20this%20break%20my%20theme%3F\"><h3>Will this break my theme?<\/h3><\/dt>\n<dd><p>No. Legitimate use (when you are logged in as an administrator) continues to work. Only unauthenticated or non-admin access to the listed paths is blocked.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Added Settings \u2192 Balada Fix page to configure blocked paths.<\/li>\n<li>Support for multiple paths (one per line).<\/li>\n<li>Default path: tdw\/save_css.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release. Blocked unauthenticated access to tdw\/save_css.<\/li>\n<\/ul>","raw_excerpt":"Blocks unauthenticated access to vulnerable REST paths. Add paths in Settings \u2192 Balada Fix. Only admins can use them.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/292446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=292446"}],"author":[{"embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/vladanrs"}],"wp:attachment":[{"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=292446"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=292446"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=292446"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=292446"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=292446"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/bal.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=292446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}