User with admin capabilities created via POST?

[miloszryckobozenski]

Wordpress 4.9.8.

WPScan shows two issues:

[!] Detected 2 users from RSS feed:

[!] Full Path Disclosure (FPD) in '​https://embraceyourlife.pl/wp-includes/rss-functions.php': /home/hl2404/domains/embraceyourlife.pl/public_html/wp-includes/rss-functions.php

Plugins, themes, core in newest versions.

Nothing more.

I got e-mail with notification that user with admin caps was created.

In logs I found only:

174.142.75.169 - - [12/Nov/2018:23:12:08 +0100] "POST /wp-login.php?action=register HTTP/1.1" 302 4351 "-" "python-requests/2.18.1"

174.142.75.169 - - [12/Nov/2018:23:12:13 +0100] "GET /wp-login.php?checkemail=registered HTTP/1.1" 200 2789 "-" "python-requests/2.18.1"

[dd32]

Hi @miloszryckobozenski,

I got e-mail with notification that user with admin caps was created.

Unfortunately you'll probably find that two settings have been altered on your install, on the Settings -> General page, ensure that

• "Members can register" is disabled (Unless you specifically want to have users register)
• "New User Default Role" is set to something sane (By default, 'Subscriber', and not 'Administrator' as I believe it was when the user was registered)

Although all your plugins are up to date, it's likely been caused by a recent plugin vulnerability which allowed those settings to be changed at a previous date (before the plugin update) and it's just now being exploited by a user registration being made.

I'd recommend checking your other registered users as well and treat the site as hacked, check for other plugins, check for malicious code added to themes, etc.
Trac isn't a support avenue however, The ​Support Forums may be able to further assist, plus the WordPress Codex has a page on what to do next: ​https://codex.wordpress.org/FAQ_My_site_was_hacked

[!] Full Path Disclosure (FPD)

WordPress doesn't consider FPD to be a valid concern for the software, and recommends disabling the display_errors PHP directive in production. While I'll agree that it could be an "easy fix" it's not something that we're currently interested in.

​https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#why-are-there-path-disclosures-when-directly-loading-certain-files

I'm marking this as invalid, as unfortunately there's nothing included which is a bug in WordPress, just the unfortunate side effects from a bad plugin allowing a bad actor to alter settings and create users.