WordPress Website email vulnerability

LiveTevez said:

So i have website in WordPress and I'm using wordfence and cloudflare as security.

But I'm having a big problem is somehow don't ask me how, my competitors seems to be able to get all my customers email and starting to email them with offers etc.

What could it be and how can i fix this issue?

Click to expand...

TheMarquis said:

That's a very big issue. I suggest you to close the shop now, until you solve the issue, to avoid further problems

Are you host that site on a shared hosting server?
Do anyone else have access to your stuff (WordPress dashboard, cPanel, database - with admin credentials)?

---LE
If you host it on a shared server, move it to a dedicated one.
If anyone else have access to your stuff (an ex developer, an ex business partner), delete his access.

Other things to do:
1. Backup your site.
2. Scan the site for malware (nulled theme, nulled plugins and so on).
3. Change your user credentials and the salt keys. - You should also let your customers know about the issue and ask them to change their credentials.
4. After you are sure the site is clean, upload it on a new server (again, avoid the shared ones).

Good luck!
M

Click to expand...

TheMarquis said:

That's a very big issue. I suggest you to close the shop now, until you solve the issue, to avoid further problems

Are you host that site on a shared hosting server?
Do anyone else have access to your stuff (WordPress dashboard, cPanel, database - with admin credentials)?

---LE
If you host it on a shared server, move it to a dedicated one.
If anyone else have access to your stuff (an ex developer, an ex business partner), delete his access.

Other things to do:
1. Backup your site.
2. Scan the site for malware (nulled theme, nulled plugins and so on).
3. Change your user credentials and the salt keys. - You should also let your customers know about the issue and ask them to change their credentials.
4. After you are sure the site is clean, upload it on a new server (again, avoid the shared ones).

Good luck!
M

Click to expand...

TheMarquis said:

That's a very big issue. I suggest you to close the shop now, until you solve the issue, to avoid further problems

Are you host that site on a shared hosting server?
Do anyone else have access to your stuff (WordPress dashboard, cPanel, database - with admin credentials)?

---LE
If you host it on a shared server, move it to a dedicated one.
If anyone else have access to your stuff (an ex developer, an ex business partner), delete his access.

Other things to do:
1. Backup your site.
2. Scan the site for malware (nulled theme, nulled plugins and so on).
3. Change your user credentials and the salt keys. - You should also let your customers know about the issue and ask them to change their credentials.
4. After you are sure the site is clean, upload it on a new server (again, avoid the shared ones).

Good luck!
M

Click to expand...

please read said:

Where do you normally send emails from?

Click to expand...

• Use reCAPTCHA to prevent bots from scraping form data.
• Disable email logging in form plugins.
• Ensure form plugin is up to date and avoid using nulled plugins
• Disable email indexingin your robots.txt:
  User-agent: *
  Disallow: /wp-content/
  Disallow: /wp-admin/
  
  
  
• Use email obfuscation plugins (e.g., WP Email Guard).
• • Change database table prefixes (wp_ → something random).
  • Use Wordfence’s WAF (Web Application Firewall) to block SQL injection.
  • Check for rogue admin users under Users > All Users in WordPress.
  • Scan your website with Wordfence for malware.
• Add this to your functions.php file:
  
  add_filter( 'rest_endpoints', function( $endpoints ) {
  if ( isset( $endpoints['/wp/v2/users'] ) ) {
  unset( $endpoints['/wp/v2/users'] );
  }
  return $endpoints;
  });
  
  
  
  
• • Enable SPF, DKIM, and DMARC records in your email provider.
  • Use email logging plugins to check if unauthorized emails are being sent.
  • Check server logs for unauthorized access attempts.
• Hope it will help you to recover all this unwanted issues

Software Monster said:

• Use reCAPTCHA to prevent bots from scraping form data.
• Disable email logging in form plugins.
• Ensure form plugin is up to date and avoid using nulled plugins
• Disable email indexingin your robots.txt:
  User-agent: *
  Disallow: /wp-content/
  Disallow: /wp-admin/
  
  
  
• Use email obfuscation plugins (e.g., WP Email Guard).
• • Change database table prefixes (wp_ → something random).
  • Use Wordfence’s WAF (Web Application Firewall) to block SQL injection.
  • Check for rogue admin users under Users > All Users in WordPress.
  • Scan your website with Wordfence for malware.
• Add this to your functions.php file:
  
  add_filter( 'rest_endpoints', function( $endpoints ) {
  if ( isset( $endpoints['/wp/v2/users'] ) ) {
  unset( $endpoints['/wp/v2/users'] );
  }
  return $endpoints;
  });
  
  
  
  
• • Enable SPF, DKIM, and DMARC records in your email provider.
  • Use email logging plugins to check if unauthorized emails are being sent.
  • Check server logs for unauthorized access attempts.
• Hope it will help you to recover all this unwanted issues

Click to expand...

LiveTevez said:

I'm using Gsuite

Click to expand...

please read said:

Understood. What are you using to collect emails?

Click to expand...

LiveTevez said:

What you mean by collecting emails?

Click to expand...

please read said:

I'm just trying to understand your setup. So you send email from Gsuite but how do you get users' email addresses in the first place?

Click to expand...

LiveTevez said:

They place an order on my website which they add their email.

Click to expand...

LiveTevez said:

They place an order on my website which they add their email.

Click to expand...

LilMosey said:

Where are their emails stored? Do you have directory browsing disabled? Used any nulled themes/plugins in the past?

Click to expand...

please read said:

Did you already run scan in Wordfence for changes in Wordpress file / core files?

Click to expand...

Software Monster said:

• Use reCAPTCHA to prevent bots from scraping form data.
• Disable email logging in form plugins.
• Ensure form plugin is up to date and avoid using nulled plugins
• Disable email indexingin your robots.txt:
  User-agent: *
  Disallow: /wp-content/
  Disallow: /wp-admin/
  
  
  
• Use email obfuscation plugins (e.g., WP Email Guard).
• • Change database table prefixes (wp_ → something random).
  • Use Wordfence’s WAF (Web Application Firewall) to block SQL injection.
  • Check for rogue admin users under Users > All Users in WordPress.
  • Scan your website with Wordfence for malware.
• Add this to your functions.php file:
  
  add_filter( 'rest_endpoints', function( $endpoints ) {
  if ( isset( $endpoints['/wp/v2/users'] ) ) {
  unset( $endpoints['/wp/v2/users'] );
  }
  return $endpoints;
  });
  
  
  
  
• • Enable SPF, DKIM, and DMARC records in your email provider.
  • Use email logging plugins to check if unauthorized emails are being sent.
  • Check server logs for unauthorized access attempts.
• Hope it will help you to recover all this unwanted issues

Click to expand...