I administer a number of WordPress-powered web sites.

One of these sites is new, and has been running untouched since it was set up a month ago. Today, I tried to log in, but was unable to do so - all my login attempts were rejected.

After some investigation, I found out that the wp_users table was missing. All other tables were present, and the blog was fully functional.

None of the entries in the database, nor any of the files suggest that there has been any kind of hacking going on.

I'm due for vacation tomorrow, and this leaves a bit of a worry as I'm the only person taking care of these sites. I've altered all the passwords, of course, and I might do a reinstall of the code base, but I'd like to know whether there is any common bug that could have caused this?

The WP version running is 3.4.1. Noteworthy installed plugins include WP Super cache, All in one SEO pack, and User Photo.


First ... I assume you have a backup of your SQL to restore from?

It seems odd that you have lost only one table - why not all the tables in the database?

Not Hacked
htaccess rules corrupt / wp supercache / permalinks?? When you say you can't login .. is there an error? can you get to the password reset screen? /wp-login.php?action=lostpassword

If you think this might be the case, you could start by renaming the plugin folder to old.plugin this will deactivate them all ... then update the .htaccess rules and delete all the WP-SuperCache bits.

Can you restore from a SQL backup?
If you think you've not been hacked then maybe you need to restore from a backup of your SQL and see if it needs to be optimised / repaired?

If you can use a tool like Sequel Pro or SQLYog you'll be able to restore from your backup of your SQL dbase.

So you think you were hacked?
Can you change your FTP / sftp account details immediately :)

Then you'll have to restore from a SQL backup ...

Now open wp-config.php and delete all the values in SALT and go here to generate new SALTs This will force all users to re-login

I'm going to guess you have PHPMyAdmin (which always has an account called root) and that you can login to PHPMyAdmin from any IP address? -- this might explain how someone got in.

Check and change the password. Ask your ISP to block access to PHPMyAdmin except from your IP and get a static IP if you don't have one already.

Do you have an WordPress Administrator account called Admin and someone guessed the paswords?

There is one hope ... your hosting provider might be able to tell you who logged in to PHPMyAdmin and at what time.

|improve this answer|||||
  • Thanks Damien, I've contacted the provider to ask them for exactly that. In the meantime, I'll be changing all the passwords, updating all the plugins, and hoping for the best! It's definitely only that one table that is missing though, and it's the case in two installations out of six running on the server. Very odd. – Pekka Aug 17 '12 at 11:04
  • Can you download / make a backup of the SQL database and then inspect it in SQLYog or something ... just want to know if the database needs to be optimised / repaired? – Damien Aug 17 '12 at 11:35

I just had this happen to a client of mine and found this post through Google. Again, it was just the wp_users table that was missing. I was able to restore it from an older database backup, fortunately. She was using the default "admin" login, which might have been the weak point. She didn't have any of the three plugins installed that are listed in Pekka's original post. She hadn't updated Wordpress in awhile, though I'm not sure what version she was running.

Very strange. I'm grateful the entire database wasn't wiped, but I wonder why a hacker would only delete the wp_users table.

|improve this answer|||||
  • This is very weird. Maybe we could compare the full list of plug-ins to see what might cause this? I'm on holiday currently so I will be slow to respond, but I'd be interested in finding the cause – Pekka Aug 28 '12 at 17:51
  • I'm on vacation too, actually :) I'll post a list of the plugins when I get back. – Jennette Aug 29 '12 at 3:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.