Hacker able to create admin user name though Wordfence restricted it
-
Hi there
I am running Wordfence on my blog and the server is apparently under attack on the wordpress installations. All of my sites are up to date as far as wp version and plugin versions are concerned. I was alerted on Sunday that a user named admin had logged in, while I was asleep, and by the time I was awake the hackers had moved my files and the site was hacked. It was restored to a backup of a week before and scans now show nothing wrong with it, but the attack is still going on on that server – attacking other wp installations. I have locked down all the sites that belong to me that have wordpress installed, using Wordfence and they all have the box checked to prevent the user name admin being created if it does not already exist. None of them have admin as a user name, and I also have ‘Immediately block the IP of users who try to sign in as these usernames’ box checked with admin as the name. BUT…
On another wp site (my husband’s) I tried to log in and found that the administrative user id I had was no longer valid. When I requested a password reset it sent me the password reset link for the user name ‘admin’. Sure enough, when I logged in, with the new password, the user name admin was the only active one. I immediately created the original one (new password) and deleted the admin one. A scan revealed that a file had been changed, which I was able to revert to the original version. But how did the user create the user name admin?
The attack is still ongoing, I am just trying to figure out what I can do to make it all safe. Should I just disable all my sites on that server until the attacker goes away or the hosts fix it all?
- The topic ‘Hacker able to create admin user name though Wordfence restricted it’ is closed to new replies.
