Possible Security Issue

Today I had an issue where a bot created admin accounts on 9 WordPress sites under my control. The sites were all relatively up to date and all running the latest version of WordPress. The only real consistency out of date plugin was the Classic Editor which was 0.4. I have now updated all the sites on this server but I am concerned that there is an issue with the WordPress Core that has allowed this to happen. Has anyone seen this happen before and is there a solution?

• This topic was modified 6 years ago by tinpeas.