We've been seeing a user created out of nowhere named "wordpress" every so often, with most of our wordpress sites on a couple Ubuntu 20 servers. I run a quick audit across our server using WP-CLI to find all administrator users every once in a while, to be sure we aren't providing extra admin access to user accounts.
We then see most of our sites have a user: "wordpress" with ID "123456" no email address associated with it and registered on 9-28-2012 00:00:00
I have tried to search google/stack to see if anyone has reported the same thing happening to them, but its difficult to search for because of the keywords being used. And I don't see anything remotely mentioning this thing happening to anyone else.
Has anyone seen this, or know how its happening? I am worried its a security vulnerability that I am not aware of, or a plugin needing updating. We're not fully up to date on all wordpress and plugin updates on all sites, but many/most of them are, or at least fairly recently. We've seen this happen before on a couple sites back in 2020 so it can't be a wordpress or plugin issue for that long since we've definitely updated since then.
One thing to note is we do a lot of our updates from WP-CLI, but have also done it from admin panel using an Ubuntu user named "wordpress".... but I don't see how that would ever create a new user in our wordpress user table.
