WordPress.org

Make WordPress Core

Opened 6 months ago

Closed 6 months ago

#49276 closed defect (bug) (invalid)

spam registration increasing after update 5.3.2

Reported by: wordpresserror Owned by:
Milestone: Priority: normal
Severity: normal Version: 5.3.2
Component: Users Keywords:
Focuses: administration Cc:

Description

after I updated to latest WordPress version 5.3.2, I saw an increase in spambot registrations

https://prnt.sc/qrrium

all the spam bot new registration emails came from wordpress@…

while when I tried to use the same link that most of the spambots use to register on WordPress

https://domain.com/wp-login.php?action=register

I got the new registration email from admin@… that means the spambots are using some different methods to register on WordPress
also a spam bot had an image how did the bot upload the image?

Also, I got a woocommerce spam registration that didn’t have any name only had username and email whereas my woocommerce registration page asks for name and email and then generates the username automatically then how was the spam bot able to register without name?

Change History (6)

#1 @spacedmonkey
6 months ago

  • Component changed from General to Users
  • Focuses javascript performance privacy coding-standards removed

#2 follow-up: @audrasjb
6 months ago

Hi and welcome to WordPress Trac!

Doesn't look related to WordPress Core at a glance. Its worth investigating though.

also a spam bot had an image how did the bot upload the image?

I suppose it wasn't uploaded, but rather a gravatar image.

how was the spam bot able to register without name?

Because they are not using the registration forms but rather the API methods.

#3 follow-ups: @SergeyBiryukov
6 months ago

  • Keywords needs-patch needs-testing removed
  • Milestone Awaiting Review deleted
  • Resolution set to invalid
  • Status changed from new to closed

Hi there, welcome to WordPress Trac! Thanks for the ticket.

I'm sorry to hear you are having issues with WordPress. Please note that this Trac is used for enhancements and bug reporting for the WordPress core software, not for individual support questions.

Please try the support forums to get help with your site: https://wordpress.org/support/forums/

#4 in reply to: ↑ 3 @wordpresserror
6 months ago

  • Resolution invalid deleted
  • Status changed from closed to reopened

THIS IS NOT EVEN AN INDIVIDUAL QUESTION rather its a wordpress enhancement and development report before closing it try to understand the issue

I have explained the issue with reference to my website

as it's not like traditional spam registrations I have explained everything

just because it doesn't involve coding from my end doesn't mean its not a bug

Version 0, edited 6 months ago by wordpresserror (next)

#5 in reply to: ↑ 2 @wordpresserror
6 months ago

yeah as I checked it's a gravatar image.

also, I forgot to mention there is no email id as wordpress@… registered in my WordPress or hosting account.

so how am I getting an email from wordpress@… for all the spambot registrations but getting an email from admin@… when I try the link that most of the spambots use traditionally which is

https://domain.com/wp-login.php?action=register

definitely its worth looking into because these registrations are not the traditional ones that we used to get before WordPress 5.3.2 its something else

also, they are targetting woocoomerce too

Replying to audrasjb:

Hi and welcome to WordPress Trac!

Doesn't look related to WordPress Core at a glance. Its worth investigating though.

also a spam bot had an image how did the bot upload the image?

I suppose it wasn't uploaded, but rather a gravatar image.

how was the spam bot able to register without name?

Because they are not using the registration forms but rather the API methods.

#6 in reply to: ↑ 3 @wordpresserror
6 months ago

  • Resolution set to invalid
  • Status changed from reopened to closed

sorry I just saw you are very experienced WordPress developer so if you say so the bug is invalid I will close this ticket

I think you are correct it's not that big issue but definitely the spam registrations increased after latest update 5.3.2 even iam using Recaptcha and having so many spam registrations even after having ReCaptcha is strange

I just saw you are very experienced WordPress developer so if you say so the bug is invalid I will close this ticket

Replying to SergeyBiryukov:

Hi there, welcome to WordPress Trac! Thanks for the ticket.

I'm sorry to hear you are having issues with WordPress. Please note that this Trac is used for enhancements and bug reporting for the WordPress core software, not for individual support questions.

Please try the support forums to get help with your site: https://wordpress.org/support/forums/

Note: See TracTickets for help on using tickets.