2

I have been given a job to amend a Wordpress site. I have only been given access to Cpanel. My questions are can i log in to the back end of Wordpress via Cpanel? If you can't login via Cpanel can i change the details like username and password so i can log in?

I have tried going into mySQL database to the phpmyadmin and making it have no password but that made things worse. I tried going into all the things in my eXtend cpanel but i cant find anything that works.

  • Your best bet is to use the password reset functionality, modifying the password field via the database will not work. You should also modify your question to stress that you have database access rather than CPanel access, as it may prevent people who can answer from posting if they know what to do but they're more familiar with a rival piece of software. Could you not ask the client for login details or to create a user for you? – Tom J Nowell Nov 12 '15 at 19:23
  • 1
    Curious why you would say modifying the p/w via phpMyAdmin won't work, Tom. I've done this on sites in the past when clients didn't have their login info. Has something changed to defeat this approach? – jdm2112 Nov 12 '15 at 19:29
  • In phpMyAdmin, I would change the password a user that has admin access, but make sure the function dropdown is set to MD5 – czerspalace Nov 12 '15 at 19:30
  • Password hashes are salted, if you can MD5 a plaintext password and it works when you put it in the database then you're security is not going to cut it. These are the set of hashes and salts that you put in your wp-config.php, there's a generator at wordpress.org that will give you something you can copy paste, send all your users a password reset after adding them though – Tom J Nowell Nov 12 '15 at 23:03
  • @TomJNowell The WordPress Codex says to use the MD5 function when resetting password via phpMyAdmin codex.wordpress.org/Resetting_Your_Password#Through_phpMyAdmin At login, in wp_check_password WordPress checks if it is an md5 password, if it is then it lets the user login and also updates the password with the salt – czerspalace Nov 13 '15 at 18:44
0

There are 5 options

1) Ask The Client

You haven't been given what you need to do your work, so you should request it rather than hacking in to the clients site. This would be the Professional and ethical thing to do

2) Reset Password link

Using the standard password reset link should do the job

3) WP CLI

You can use WP CLI to set the password, or add a new administrator user.

e.g. to update the user with ID 22:

wp user update 22 --password="newpass"

4) Via The Database

Passwords are salted, but you can replace them with an MD5 hash. The caveat being that as soon as that hash is checked, if it matches the password, then it gets replaced with a salted version at:

https://core.trac.wordpress.org/browser/tags/4.9.8/src/wp-includes/pluggable.php#L2236

5) emergency.php

If all other options fail, there is emergency.php. The file is dangerous, and should be removed once used, but it will allow you to reset the password of an admin user

  1. Save the script below as a file called emergency.php to the root of your WordPress installation (the same directory that contains wp-config.php).
  2. In your browser, open http://example.com/emergency.php.
  3. As instructed, enter the administrator username (usually admin) and the new password, then click Update Options. A message is displayed noting the changed password. An email is sent to the blog administrator with the changed password information.
  4. Delete emergency.php from your server when you are done. Do not leave it on your server as someone else could use it to change your password.

But the best avenue would be to ask the client or your employer for access, it's not an unreasonable request, and it's unreasonable to ask you to break into the site in order to do work.

  • Unfortunately, you are not right. Salting does not matter. You can always just select the MD5 function and type your new password right into the database, and it will work. I've done this like million times. Salts are used for everything but passwords. Edit: even official WP documentation proves this. Link – dboris Oct 23 '18 at 13:30
  • 1
    @dboris it looks like that's for backwards compatibility, core.trac.wordpress.org/browser/tags/4.9.8/src/wp-includes/… – Tom J Nowell Oct 23 '18 at 13:34
  • You are right. I was convinced WP Core still uses plain MD5 hashing. I am glad I was wrong. :) So, the point is, password could still be changed directly in phpMyAdmin, but should be immediately changed again through the Dashboard, so that the more secure algorithm would be applied to the hash. – dboris Oct 23 '18 at 13:37
0

Unless this website is using some hashing-altering plugin like Bcrypt or similar, you can easily change the password for users using phpMyAdmin.

  1. Login to cpanel and open phpMyAdmin.
  2. Find table wp_users (prefix could differ)
  3. On the row with the user you want to change the password, click on Edit

  1. On new screen, find column user_pass, select the Function MD5, and type your new password like on screen, and click Go

  1. Now login to /wp-admin using new password, and change it to a more secure one through the Dashboard. This last step is very important, because changing password through the Dashboard applies a more secure hashing algorithm to the stored password. Please don't skip it.

More on official WordPress Documentation: Link

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.