Balada Fix
Blocks unauthenticated access to vulnerable REST paths. Add paths in Settings → Balada Fix. Only admins can use them.
Use with caution
Balada Fix works, but test it on a staging site before relying on it in 2026. It runs on 10+ sites and was last updated 4 months ago, and scores 51/100 on our health check.
- Small user base (10+ active installs)
- Very few reviews so far
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Balada Fix stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| balada | #1 |
| injector | #7 |
| rest-api | >100 |
| security | >100 |
| wp-json | >100 |
Version adoption
Share of active sites per release.
About Balada Fix
From the official readme · v1.1.0Description
Balada Fix protects your site from unauthenticated abuse of specific WordPress REST API endpoints. Such endpoints (for example the tagDiv theme’s wp-json/tdw/save_css) are often targeted by the “Balada Injector” and similar campaigns to inject malicious scripts.
- Add one or more REST path patterns in Settings → Balada Fix (one per line).
- Only logged-in administrators with the
edit_theme_optionscapability can access those paths. - Unauthenticated or unauthorized requests receive a 403 Forbidden response.
Default protected path: tdw/save_css (tagDiv / Newspaper theme vulnerability).
Installation
- Upload the plugin files to
/wp-content/plugins/balada-fix/, or install through WordPress Plugins → Add New → Upload. - Activate the plugin through the Plugins screen.
- Go to Settings → Balada Fix to review or add blocked paths (one per line, e.g.
wp-json/tdw/save_cssortdw/save_css).
Frequently asked questions
Which paths should I add?
Add the REST path that is known to be vulnerable and should only be used by admins. Example: tdw/save_css for the tagDiv Composer / Newspaper theme. You can use the full path like wp-json/tdw/save_css or the short form tdw/save_css.
Will this break my theme?
No. Legitimate use (when you are logged in as an administrator) continues to work. Only unauthenticated or non-admin access to the listed paths is blocked.
Changelog
You can now add and edit blocked paths in Settings → Balada Fix (one per line).
1.1.0
- Added Settings → Balada Fix page to configure blocked paths.
- Support for multiple paths (one per line).
- Default path: tdw/save_css.
1.0.0
- Initial release. Blocked unauthenticated access to tdw/save_css.
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
FAQ
Balada Fix: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 4, 2026
Is Balada Fix free?
Yes. Balada Fix is free to download and use from the official WordPress.org plugin directory.
Is Balada Fix safe to use in 2026?
Balada Fix works, but test it on a staging site before relying on it in 2026. It runs on 10+ sites and was last updated 4 months ago, and scores 51/100 on our health check.
How many websites use Balada Fix?
Balada Fix is active on 10+ WordPress websites and has been downloaded 366 times since it launched in March 2026. It was downloaded 51 times in the last 30 days.
Does Balada Fix work with WordPress 7.1?
Balada Fix is officially tested up to WordPress 7.0.6, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
What PHP version does Balada Fix need?
Balada Fix requires PHP 7.2 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Balada Fix last updated?
The latest version, 1.1.0, was released on June 18, 2026 (4 months ago).
Who makes Balada Fix?
Balada Fix is developed and maintained by vladanrs.
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
