Blocks unauthenticated access to vulnerable REST paths. Add paths in Settings → Balada Fix. Only admins can use them.

vladanrs

Balada Fix protects your site from unauthenticated abuse of specific WordPress REST API endpoints. Such endpoints (for example the tagDiv theme’s <code>wp-json/tdw/save_css</code>) are often targeted by the “Balada Injector” and similar campaigns to inject malicious scripts.
<ul>
<li>Add one or more REST path patterns in Settings → Balada Fix (one per line).</li>
<li>Only logged-in administrators with the <code>edit_theme_options</code> capability can access those paths.</li>
<li>Unauthenticated or unauthorized requests receive a 403 Forbidden response.</li>
</ul>
Default protected path: <code>tdw/save_css</code> (tagDiv / Newspaper theme vulnerability).

Alternatives to Balada Fix

Top alternatives