Locked Out Of Wordpress, Can't Reset Through PHPMyAdmin

Question

I am locked out of an installation I haven't logged into for ages and can't seem to find a way back in. I've tried the standard lost password dialog, it just tells me I have an invalid key when clicking the reset link.

I have tried logging in following this thread using a third party MD5 hash generator and still nothing. I've tested it both ways and can see the MD5 hash is the same as the one generated by PHPMyAdmin, so that's not the issue.

Is there something more sinister going on here? I updated to the latest version of Wordpress using Softaculous through cPanel. The site itself looks fine, but I'm just worried it might compromised with some type of malware preventing me from logging in. I could always rebuild the site, but it just so happens a client of mine is running into a similar issue, so I'm hoping I don't have to rebuild multiple sites.

Answer 1

You could just programmatically add a new user to the site.

This is a snippet from a utility I use to gain access to WordPress sites when I don't have the login info. Just upload it to a file in your wordpress root and navigate to it:

require_once('wp-blog-header.php');
require_once('wp-includes/registration.php');

$user_id = wp_create_user( 'newusername', 'newpassword' );
if ( is_int($user_id) )
{
    $wp_user_object = new WP_User($user_id);
    $wp_user_object->set_role('administrator');
    echo 'Successfully created new admin user. Now delete this file!';
}
else {
    echo 'Error with wp_insert_user. No users were created.';
}

Make sure you delete the file when you're done.

If you still can't login with the new user, try deactivating all of your plugins (you can just change the directory names since you can't access them in the backend).

You may also want to ensure that none of your core files have been modified. Completely delete the wp-admin and wp-includes directories and grab fresh ones from a clean copy of WordPress.