Last week we received an email from our WordPress saying that the admin email got changed to admin@example.com By checking the logs using the WP Activity Log plugin, I can see that the action was done by the 'System' user from the IP Something to note: it doesn't seem to be a valid user, any other record on the logs is showing the actual user that performed the action. Of course that IP is already blocked, now I'm wondering how somebody managed to change a system setting remotely without having a valid account. Does anybody have any clue on what happened?

Running WordPress 5.8.2, all the plugins updated

  • Welcome to wpse! I would start with checking your plugins, checking review for them and possible vulnerabilities. for example WPS Hide Login is supposed to hide the login page by renaming wp-login to whatever you want, but there was a vulnerability that you could expose this page (completly making the whole plugin pointless). So my guess is there is a plugin that has a backdoor that allows those kind of actions to happen. I would also suggest asking your hosting for a access log to see what this IP tried to access. Dec 13, 2021 at 7:38
  • Thanks @Buttered_Toast! Checked your suggestions, and haven't yet found how that was even possible. There was no session at all, no valid username... somehow they managed to impersonate and become the 'System' user, then they changed that setting (thankfully nothing else got broken!)
    – nnimis
    Dec 13, 2021 at 23:25
  • @nnimis were you happen to be using Publishpress plugin?
    – Kumar
    Dec 22, 2021 at 7:15
  • @Kumar no, we're not using that
    – nnimis
    Dec 30, 2021 at 17:19

2 Answers 2


A detailed why or how is not going to be possible with the limited information you've provided. For a detailed forensic investigation we would need more than just an IP and arbitrary Username, in fact we would need everything... DB, access logs, changelogs, codebase - quite literally everything you've got and even then it's not easy, and not always possible to track down the exact cause. Even if you have the correct logs, once an attacker has access to your systems - those logs can potentially be doctored or deleted.

The best I can suggest is that if you use any of these ​​

  • Kiwi Social Share
  • ​​WordPress Automatic and Pinterest Automatic
  • PublishPress Capabilities
  • various Epsilon Framework themes

That there was a massive spike in attacks recently targeting known vulnerabilities in those plugins - see 1.6 Million WordPress Sites Hit With 13.7 Million Attacks In 36 Hours. These were recently disclosed vulnerabilities and ruthlessly targeted, with the time between disclosure and these attack vectors seen in the wild "en masse" being quite small. The time needed to patch your systems is getting smaller. Having up-to-date plugins the day after an attack won't save you.

Having said that, there are several ways you can keep on top of managing these potential threats.

Automatic updates - make sure that patch updates - IE the change in the last number X.X.(me!) are done immediately - patches don't generally contain breaking code changes when possible. Update on your test server, quick look and check on your vitals, then push live...

Keep abreast of the threats out there - I regularly read and subscribe to several vulnerability databases. For example:

Tool up - there are some tools to use - free and paid. Mostly the security by obscurity stuff doesn't work (you know what I mean - the hide login / wp-admin plugins - or the wp-xxxx folder rewrite plugins) but it can protect you from the brunt of some brute force "dumb" attacks. If it buys you an extra 12 hours to patch your plugins, that's 12 hours that can save your site from compromise. They are not to be relied on as "security" merely a layer of defence that slows down potential attacks. Brute force login protection is probably one of the more useful precautions here. The number of insane admin passwords I have been given during my freelancing days make me shudder - what are you doing if your main admin login is admin and Companyname1 as the super-admin?? I would regularly find logs on my sites to see 1,300 hits a day on guessing logins - those are on small sites from different IPs.

Tidy up - don't leave unused plugins active. If you're not using them, deactivate it. Each line of running code is a potential entry point to your site... At time of writing, that Patchstack page mentioned above - each page contains 20 vulnerabilities. Page one only goes back 5 days and I think that's because of the weekend...

Use your head - if you're installing a plugin that hasn't been updated in 2 years - please have a quick think... does that sound sensible?

Off the shelf - some tools can help you stay safer and offer a basic firewall-style protection.

Are two of the more popular choices and receive automatic firewall updates - although you will have to pay for the more advanced protections.

Infrastructure - there's no point in doing any of the above things if your infrastructure isn't secure. I don't need to compromise your plugins, logins or database if you use GoDaddy don't secure your infrastructure. Lock down SSH access - only allow server login with a secure key and please, it's so simple... Make a #@!$ing secure password to login to your server dashboard.

There are more and countless blogs on this. Just remember, we are pretty much now at the stage of - your site will be compromised... it's a fair amount work to make sure it isn't. Regularly audit your site contents - in terms of information stored... PII (Personally Identifiable Information) should be kept to a minimum for both you and your users. It's much less of a headache if or when something might happen.

I have no affiliation with any of the services mentioned above.

  • Thanks @Bysander, great explanation! But I still can't figure out how the action was performed. I know that it was an attack, either they succeeded or not. Wordfence blocked other actions from that IP, so I'm not clear on how they still managed to perform that action.
    – nnimis
    Dec 28, 2021 at 19:46
  • Hi @nnimis - Wordfence may well have blocked the later actions in the attack once it recognised a specific attack vector. Be aware that the free version of Wordfence will only start blocking most known / released vulnerabilities after 30 days so if you're in that 30 day danger period your site will essentially be unprotected against those known vectors for 30 days before the rules are added to the firewall.
    – Bysander
    Jan 4, 2022 at 9:42

With database access through PHPMyAdmin it would be possible to change the admin email address. This change might show up in the WP Activity Log plugin as coming from 'System' (I haven't checked this). So at this point I would assume a hacked website and/or hacked hosting.

Rather than figuring out how it happened, I would look at when it happened and see if I could restore a backup from before that date. Then I'd change all my passwords and start going through the post-hack steps detailed on wordpress.org.

Update On a test-site I've changed the admin email through PHPMyAdmin while the WP Activity Log plugin was active, and that change didn't get recorded by the plugin.

This plugin support topic states that:

The plugin reports the user system then the change was done via the system itself. This means that the change was most probably done via an automated process on your website. It could be WordPress itself, or maybe some plugin you have running [...]

Another thought is that someone could have created a (possibly hidden) user called 'System' and made the change with that. If the change was recorded in WP Activity Log, then this would suggest the change was made from within WordPress; not your hosting environment.

Still feels like the site was hacked - or that's what I'd assume to be on the safe side.

  • Thanks @Dvaeer, we don't have any attacks on the SQL side and PHPMyAdmin is not even installed. The IP got automatically blocked after that action so I'm still wondering how did they got to change it without accessing the DB nor having a valid WP user.
    – nnimis
    Dec 28, 2021 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.