Admin password keeps changing

Question

The admin password keeps changing without me authorizing it. I've gone in the back end through phyMYAdmin to change the password to something different, which works for a few days or hours, but then stops working again. I'm up to date with my WP version and hosed on GoDaddy.

Is this a hacker/virus of some sort or is there something wrong with my install. It only started happening a day or so ago, but this is the 4th time I've had to manually reset the password.

Thanks for any help

Answer 1

This might be something weirdly broken, but it does seem a lot like a hack. You probably should notify your hosting about this and (if you are up to it) check server logs for access from unknown IPs.

Also I hope you are running latest version? I remember there was vulnerability in some 2.8.x version that allowed to reset admin password (not gain access to it, just reset).

Answer 2

Geez, that doesn't smell right to me. I have this funny faith in systems being deterministic, and that type of behavior doesn't come under that heading. Once a system starts acting "funny" I get all show me about proving that it hasn't been hacked, rather than waiting for something obvious (like your browser exploding in flames).

I would check all of your other users and verify that none of them have elevated privileges. I also suggest doing a full crawl of your own site (from an outside system), collect all of the hrefs and srcs, and see if any of the URLs don't look right. Also check your .htaccess file and see if it looks good. I had a customer's site hacked about 18 months ago and the primary damage was some extremely weird stuff in the rewrite rules plus some virus files being delivered as if they were images. We only discovered it when our Google Rank drop through the floor because of some 404s.

There have been some old reports of general methods to hack into WP sites. I mention it because you are running older stuff so it may be vulnerable to this (or something similar).

Answer 3

This is a hack, I know several people who this is happening to right now. It's either a virus or a low level keyloger that can evade a virus scan. It's able to achieve it's aims on Linux, so it's not a petty piece of mail-ware. This is something that needs to be eradicated and the perpetrators caught and put on trial. It's basically made it imposible for me to use the internet, and given that I am house bound that isn't a small thing.