NEW Administrator Added – IP from Slovakia!!! | WordPress.org

TheSeoGuy
(@theseoguy)

9 years, 9 months ago

This morning I received an alert message from Wordfence that an Administrator had signed into Bora-Bora-Insider.com as follows:

A user with username ” ” who has administrator access signed in to your WordPress site.
User IP: 94.136.150.28

When I checked, there was indeed a new Administrator user there! Now deleted, but I’m puzzled and concerned at how this could occur without alarm bells ringing…

I’ve never seen a successful Administrator registration executed before!

Any suggestions would be gratefully received!

Cheers
Ben

https://wordpress.org/plugins/wordfence/

Viewing 3 replies - 1 through 3 (of 3 total)

Scott Dayman
(@sdayman)

9 years, 9 months ago

It sounds like someone else had a similar problem:
http://wordpress.org/support/topic/admin-no-name-added?replies=3

BuiltWithWP
(@builtwithwp)

9 years, 9 months ago

I’ve had this, also. Two sites, same server (shared hosting).

I chased this up with my host to see if they’d been auditing MySQL entries, which they had, so I could investigate something myself and they also said that the IP address had also been probing other sites on the server for the Wysija-Newsletter plugin.

Interestingly, I had a Wordfence ‘blacklisted user’ email, today, for the NULL user trying to log in. Same IP address.

So, maybe it was a Wordfence bug, as they suggest in that other post, that’s been fixed now.

If you search around there are hits for this dating back to last year.

UseShots
(@useshots)

9 years, 9 months ago

This sounds like this attack http://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.html

It is always from this IP 94.136.150.28

Most likely they use vulnerability in one of your plugins to create that user and then they log in.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘NEW Administrator Added – IP from Slovakia!!!’ is closed to new replies.

In: Plugins
3 replies
4 participants
Last reply from: UseShots
Last activity: 9 years, 9 months ago
Status: not resolved