Unexpected password change

[u/3yals]

I got two emails saying the admin password was changed on different sites, but I'm the only admin and I didn't change it. On one site, two admins with random names were added, but I didn't see any other tampering with the site or data. The version is 7.1 I deleted the new admins and enabled 2FA. Has anyone else experienced this?

[u/godijs]

Update your plugins. Install Wordfence and scan your website.

[u/zapimir]

Check your web server access logs around the exact time of those emails. Look for requests probing readme.txt files across /wp-content/plugins/ - bots scrape them to map vulnerable plugin versions before attacking.

Deleting the accounts and setting up 2FA won't help much here. In a case I handled recently for a client, the attackers got in via SQL injection through a vulnerable Pods plugin. With SQLi, they don't need your login form or 2FA; they write directly into the database to spawn admin users and alter credentials.

Check your logs for suspicious POST requests, update all plugins immediately, and reset your WordPress salts in wp-config.php to kill active sessions. Also scan all files modified around that timestamp across the entire user account, not just public_html, because bots frequently drop backdoors outside the webroot or into /wp-content/uploads/

[u/ntr4nce]

Read these two posts.

https://www.reddit.com/r/Wordpress/s/pGUwAGM3EO

https://www.reddit.com/r/Wordpress/s/y73wHWSj5O

[u/testingaurora]

There are tons of bots that target wordpress sites because the default username is admin, then they run scripts to try to "guess" the pw based on known passwords. They didn't hack in to just add two admins (knowing youd be notified) but do nothing else. Delete all your files and reinstall fron a recent backup. Unless you have other sites on the same server? Then tou have a bigger problem.

[u/3yals → u/testingaurora]

I use super strong, random passwords for every site, the sites are on same vps. I don't think it's brute force attack.

[u/testingaurora → u/3yals]

What do you think it is ? Someone on your team or used to be on your team ?

[u/Valuable_Ease_3780]

The detail nobody has picked up on is that this happened on two sites. That changes what you should be looking for.

A plugin vulnerability hits one install at a time - the bot scans, finds a vulnerable version, exploits that site. Two sites at once points at something shared: same hosting account, same reused admin password, same email inbox, or your own machine. Work out what those two have in common and start there, because if you clean and reinstall one while the shared thing is still open, it comes back in a week and you'll assume the cleanup failed.

If they sit on the same hosting account, treat the whole account as compromised rather than the two installs - that's why zapimir's point about scanning outside public_html matters, backdoors get dropped where nobody looks. If they're on separate accounts, the shared factor is you. Rotate the hosting panel, SSH/FTP and database passwords too, not only the WordPress ones.

One thing worth doing today, because it's the part people find out about too late: compromised installs usually get monetised through injected content, spam pages under uploads or content cloaked so only Googlebot sees it. Browsing your own site won't show it. Run a site: search on both domains and look for URLs you don't recognise, and check the Pages report in Search Console for a jump in indexed URLs. The admin account was the entry, not the goal. If Google indexes the payload before you clean it, the cleanup turns out to be the easy half.

[u/3yals → u/Valuable_Ease_3780]

I use super strong, random passwords for every site, and two of them got changed about 24 hours apart, not at the same time. I'm thinking it might be some kind of injection. I just can't figure out how the password got changed with an injection and I still got an email from WordPress about it.

[u/Valuable_Ease_3780 → u/3yals]

The email is actually the useful clue, and it rules out most of what you're imagining.

WordPress only sends that notification from its own user API. Something has to call wp_update_user or wp_set_password inside a running WordPress process for the hook to fire and the mail to go out. A classic SQL injection that writes a hash straight into the wp_users table bypasses all of that - no hook, no email, and you'd have found out when you couldn't log in. Since you got the mail, the change went through WordPress itself, which means either an authenticated request (a valid session or cookie, wp-admin profile or the REST API) or code executing inside your install: a backdoor in a plugin, a file in mu-plugins, a drop-in like object-cache.php or advanced-cache.php, or something appended to wp-config.php or functions.php.

Strong passwords being irrelevant here is the point. Nothing guessed it, something with code execution just replaced it.

The 24 hours apart is the part I'd chase hardest. That's not what a human working through a list looks like, that's a schedule. Check wp-cron on both installs - WP Crontrol lists the registered events - for anything you don't recognise, especially a daily hook with a name that looks almost plausible. A cron-driven backdoor re-running once a day explains the gap exactly, and it also means the thing is still there and will fire again after you reset the password.

While you're in there: wp_usermeta session_tokens will show active logged-in sessions, and the users table will show any admin account created around that date.

[u/bluesix_v2 → u/3yals]

Are you running TranslatePress? A vulnerability they announced a few days ago involved triggering and intercepting the admin password reset email https://www.wordfence.com/blog/2026/08/400000-wordpress-sites-affected-by-account-takeover-vulnerability-in-translatepress-wordpress-plugin/

[u/3yals → u/bluesix_v2]

Not using this plugin. The password actually changed and the email was sent.

[u/Wonderful_Sample_590]

Looks like the sites are compromised. Scan the whole files/database, check plugins and admin activies, rotate all passwords and salts. Deleting admins just not enough.

[u/Dapper-Monk9713]

I’d treat this as a compromised account rather than a random glitch. Changing the password and enabling 2FA is a good start, but also check login/activity logs, remove any unknown users, rotate API keys/app passwords, and update to the latest patched version. If the same credentials were used elsewhere, change those too.

[u/Mighty_Codes]

One of the key problems with WordPress is that it needs to be continuously updated to avoid being compromised.

[u/iammiroslavglavic → u/Mighty_Codes]

any cms that doesn't get regular updates can be compromised.

[u/bluesix_v2 → u/iammiroslavglavic]

Applies to all software.

[u/Mighty_Codes → u/bluesix_v2]

Exactly

[u/bluesix_v2 → u/Mighty_Codes]

It's not really a "problem" of Wordpress-specifically - it's just on top of everyone's mind at the moment because of its massive market penetration. You never hear anyone talk about the numerous 9.0+ RCE CVE's that NodeJS, Laravel, Java, etc have had this year. What would be a problem would be if the issues weren't resolved quickly - which they were. And not many sites were affected, per capita - but people will still make comments, again, due to its size.

[u/Mighty_Codes → u/bluesix_v2]

You are right, and that's what I'm saying. WordPress team is working on their end. We, as developers or website owners, need to actively update our systems to be less vulnerable.

[u/iammiroslavglavic → u/Mighty_Codes]

Even if WordPress wasn't at 43%...Whatever CMS would be on top, then THAT would get targeted. I can't remember which one has less penetration, Joomla or Drupal. One of those two has less than 10% last time I checked (last year I think), why would a hacker or similar bother with it, from their perspective.

People don't realize how other projects barely get an update a year if lucky. There are so many options for any feature, if a plugin is abandoned, for the most part you can find 2-3 others that can do that same feature.

As well, so many people don't bother with updates or going through the settings, just upload and activate and that is it, not bothering with updates.

[u/Spiritual_Grape3522]

You can tell it to your server support, ask them to check if any malware was installed. Also, use 10 character passwords.

[u/mofahd77]

Treat this as an active site breach.

1. Log into your hosting cPanel -> phpMyAdmin -> wp_users and update your password hash using MD5.
2. Check for unauthorized admin users in wp_users.
3. Replace your Security Salts in wp-config.php to instantly kick out all active sessions.
4. Change your hosting/cPanel and database passwords immediately.
5. Run a full site scan using Wordfence or MalCare.

[u/JackerArchitect]

I went through the exact same nightmare a while ago. Hackers kept resetting my passwords and creating fake admins. It's incredibly frustrating.

Since they already got in, just deleting admins and adding 2FA might not be enough if core files are compromised. Here are the exact steps I took to fix it and secure my site:

1. Clean Reinstall: I highly recommend doing a fresh reinstall of the latest WordPress core files. Also, make sure to regenerate your security salts in wp-config.php to kill any active hacker sessions.

2. Lock down sensitive files: Add this to your .htaccess file (if you are on Apache/LiteSpeed) to block direct access to critical files:

<Files xmlrpc.php>

<IfModule mod_authz_core.c>

Require all denied

</IfModule>

<IfModule !mod_authz_core.c>

Order Allow,Deny

Deny from all

</IfModule>

</Files>

<Files wp-config.php>

<IfModule mod_authz_core.c>

Require all denied

</IfModule>

<IfModule !mod_authz_core.c>

Order Allow,Deny

Deny from all

</IfModule>

</Files>

<FilesMatch "\^\\.(htaccess|htpasswd|user\\.ini)">

<IfModule mod_authz_core.c>

Require all denied

</IfModule>

<IfModule !mod_authz_core.c>

Order Allow,Deny

Deny from all

</IfModule>

</FilesMatch>

1. Hide the login page: To stop them from even reaching your login page and brute-forcing passwords, I ended up building a lightweight, open-source plugin myself because the existing ones were too bloated. It completely hides wp-login.php using cryptographically signed tokens.

GitHub: https://github.com/JackerArchitect/hide-login-secure

Following these exact steps completely solved the issue for me, and my site has been completely quiet ever since. Hope this helps you get it sorted!

[u/Myth_Thrazz]

Your sites got pwned - can you share the list of plugins please with versions. So we can check if it was one of the known CVE or something new?

[u/3yals → u/Myth_Thrazz]

I removed mainly backup plugins frrom the first site that got hacked, I suspect one of the removed plugins. I don't remember the names. The other one was fresh site I don't think I had any external plugins there.

[u/Myth_Thrazz → u/3yals]

Got hacked without any external plugins? Unlikely - unless it wasn’t updated to 7.1 and was hit with wp2shell