1

I just rehosted a site for a client, and am now receiving emails from the site stating I've recently requested to have the administration email changed. I didn't request it, and I've deleted the account the former admin could have used to log in. I've also changed all other passwords, and the host has changed.

This is the second time this has happened. The first time, I tried clicking the link to see if it would tell me the proposed new email that was requested, but instead it just authorized the change. And I couldn't change it back, because the confirmation email went to the new, unauthorized email. So I changed it directly in the database and now know better than to click the link.

I am trying to figure out how these emails are being generated...any ideas? Email I'm receiving is below.

Thanks!

Howdy [name],

You recently requested to have the administration email address on your site changed.

If this is correct, please click on the following link to change it: https://siteurl.com/wp-admin/options.php?adminhash=[hash]

You can safely ignore and delete this email if you do not want to take this action.

This email has been sent to [current admin email]

Regards, All at sitename http://siteurl.com

Improve this question

3 Answers 3

Reset to default
3

I think someone entered the password reset form and you probably have an easy user login for the administrator like 'admin' or so, so that's what they probably entered.

The email also says:

You can safely ignore and delete this email if you do not want to take this action.

So just ignore it.

Improve this answer
1
  • Well, no, IMHO not a good idea to ignore it. Someone has admin-level access to the admin user's account profile page, and is trying to change the email value there. So, since the OP says that nobody but him should have admin access, there is an issue here that shouldn't be ignored. Checking for users with admin privs that shouldn't have those privs is important. Changing passwords on all admin accounts is also a good idea. But it should not be ignored...this is a potential security risk!
    – Rick Hellewell
    Commented Apr 8, 2018 at 1:21
1

This is not the email sent from the reset password form.

This email is sent when update_option_new_admin_email() is run, which is when the site_admin option is changed. This option is found under /wp-admin/options-general.php so whoever is attempting to change the site admin email has access to that page. This user must have the manage_options capability and by default that is only granted to user with the administrator role.

If this happens again, you can look at the adminhash option in the database or by PHP:

$adminhash = get_option( 'adminhash' );
$email = $adminhash[ 'newemail' ];
Improve this answer
1
  • I deleted the original admin account and created a new one. I suppose the previous admin could have access to the owner's email account and may have reset the password. I will just remove his account. Meanwhile, I tried to look in the db for the adminhash option but couldn't find it. Can you please tell me briefly where to find it and what I could glean from it? Thanks a lot!
    – libbynotzoey
    Commented Apr 7, 2018 at 5:46
0

In addition to what @beee sez: You might want to create a new admin-level user, log in as that user, then delete (or demote) the 'admin'-named user. Change the email for that admin user to something else. Then you won't care if someone tries to brute-force the user named 'admin'.

Improve this answer
1
  • I had already deleted the admin account, but whoever's trying to change the admin email may somehow have access to the owner's email, who I also made an admin. I'll reverse that. Thanks.
    – libbynotzoey
    Commented Apr 7, 2018 at 5:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.