We've been seeing a user created out of nowhere named "wordpress" every so often, with most of our wordpress sites on a couple Ubuntu 20 servers. I run a quick audit across our server using WP-CLI to find all administrator users every once in a while, to be sure we aren't providing extra admin access to user accounts.

We then see most of our sites have a user: "wordpress" with ID "123456" no email address associated with it and registered on 9-28-2012 00:00:00

I have tried to search google/stack to see if anyone has reported the same thing happening to them, but its difficult to search for because of the keywords being used. And I don't see anything remotely mentioning this thing happening to anyone else.

Has anyone seen this, or know how its happening? I am worried its a security vulnerability that I am not aware of, or a plugin needing updating. We're not fully up to date on all wordpress and plugin updates on all sites, but many/most of them are, or at least fairly recently. We've seen this happen before on a couple sites back in 2020 so it can't be a wordpress or plugin issue for that long since we've definitely updated since then.

One thing to note is we do a lot of our updates from WP-CLI, but have also done it from admin panel using an Ubuntu user named "wordpress".... but I don't see how that would ever create a new user in our wordpress user table.

Wp CLI Admin User list

  • I haven’t heard of hacks creating users before. Do you have any record of this user logging in? I can’t remember if there’s a last login time in the user record or meta. Does anyone else have shell access to the server? Ditto I can’t remember if it’s possible to create a fixed user ID through WordPress APIs but I’d guess not, so sounds like they’re running SQL to do this.
    – Rup
    Oct 14 at 8:29
  • I don't see a way after the fact to get user login details. I thought it was in user meta data but I don't see anything for any user there. I know there's plugins you can install for that, but I've since deleted all worpress users. I've tested using WP CLI without an email but that's a required field. The user ID being 123456 and the date registered is too specific as that is not a default for mysql inserts. But at the same time, not sure how a user can be created in the DB without required fields if not direct to mysql. Both backend admin and WP CLI won't let you. It's very odd. Oct 16 at 16:55
  • Also my auto-increment value on all these user tables are "123457" now, as that was also set based on the last insert value. Oct 16 at 16:58


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.