0

We've been seeing a user created out of nowhere named "wordpress" every so often, with most of our wordpress sites on a couple Ubuntu 20 servers. I run a quick audit across our server using WP-CLI to find all administrator users every once in a while, to be sure we aren't providing extra admin access to user accounts.

We then see most of our sites have a user: "wordpress" with ID "123456" no email address associated with it and registered on 9-28-2012 00:00:00

I have tried to search google/stack to see if anyone has reported the same thing happening to them, but its difficult to search for because of the keywords being used. And I don't see anything remotely mentioning this thing happening to anyone else.

Has anyone seen this, or know how its happening? I am worried its a security vulnerability that I am not aware of, or a plugin needing updating. We're not fully up to date on all wordpress and plugin updates on all sites, but many/most of them are, or at least fairly recently. We've seen this happen before on a couple sites back in 2020 so it can't be a wordpress or plugin issue for that long since we've definitely updated since then.

One thing to note is we do a lot of our updates from WP-CLI, but have also done it from admin panel using an Ubuntu user named "wordpress".... but I don't see how that would ever create a new user in our wordpress user table.

Wp CLI Admin User list

3
  • I haven’t heard of hacks creating users before. Do you have any record of this user logging in? I can’t remember if there’s a last login time in the user record or meta. Does anyone else have shell access to the server? Ditto I can’t remember if it’s possible to create a fixed user ID through WordPress APIs but I’d guess not, so sounds like they’re running SQL to do this.
    – Rup
    Commented Oct 14, 2023 at 8:29
  • I don't see a way after the fact to get user login details. I thought it was in user meta data but I don't see anything for any user there. I know there's plugins you can install for that, but I've since deleted all worpress users. I've tested using WP CLI without an email but that's a required field. The user ID being 123456 and the date registered is too specific as that is not a default for mysql inserts. But at the same time, not sure how a user can be created in the DB without required fields if not direct to mysql. Both backend admin and WP CLI won't let you. It's very odd. Commented Oct 16, 2023 at 16:55
  • Also my auto-increment value on all these user tables are "123457" now, as that was also set based on the last insert value. Commented Oct 16, 2023 at 16:58

1 Answer 1

1

It could be that you have the Post SMTP plugin installed. There is an exploit in this plugin: https://patchstack.com/database/vulnerability/post-smtp

The issue has been fixed in version 2.8.8 and above.

1
  • Thanks for the suggestion. We don't use that plugin and I did check across our server for a match of the plugin folder just in case. Good news is that I did a global admin user search and I see no rogue admin users that were somehow created. So whatever it was, seemed to resolve. Maybe another similar vulnerability that was updated. But your answer reminded me to check again after 7 months now and so far nothing. Commented May 14 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.