"Login details" spam sent by from the account registration page

[cweiske]

Wordpress sites with open registration are used to spam me.

I am getting mails from WordPress installations that look like this:

Subject: [Legit site] Login Details

Username: www.spammer.example.com - 1.2342 BTC

To set your password, visit the following address:

https://legitsite.example.net/wp-login.php?login=www.spammer.example.com%20-%201.2342%20BTC&key=oSxUtw01QIFHoxHvokfd&action=rp

https://legitsite.example.net/wp-login.php

There are two problems:

1. The username allows spaces, which means the spammer can enter a domain name and a custom text
2. E-Mail clients autolink domains beginning with "www.", which is why all the 50+ registration spam mails I got have user names beginning with "www."

Two things should be fixed here by WordPress:

1. Reject usernames with spaces
2. Reject usernames that have "www." in them, because that causes the e-mail clients to autolink the URL

[cweiske]

Patch

Wordpress registration e-mails are used to send bitcoin spam to people - by using usernames with spaces like

www.spammer.example.com - 1.2342 BTC

This patch filters out usernames that begin with "www." or contain " www." - such names are auto-linked by email clients and made clickable.

Documented occurences of that spamming problem:

• ​https://cweiske.de/tagebuch/wordpress-registration-spam.htm
• ​https://www.reddit.com/r/Wordpress/comments/1gyyhx7/spammed_with_100_fake_wordpress_login_emails_help/

Fixes #63085.

Trac ticket: https://core.trac.wordpress.org/ticket/63085

## Use of AI Tools

AI assistance: No

[cweiske]

updated patch

I've added a unit test.

[cweiske]

patch #3 with unit test

The tests failure is a flake; it has nothing to do with my code.

[cweiske]

How to test

1. Enable registration: General Settings > Membership > Anyone can register
2. Log out, open the login form and click "register"
3. Enter "www.spammer.com 123 BTC" as username, and a dummy e-mail address.
4. Submit the registration form. The username will be rejected.
5. Try to register again, this time as username "123 Bitcoin www.spammer.com"
6. Submit the registration form. The username will be rejected.
7. Try to register again with a username that does not begin with "www." and does not contain "<space>www.". This username will not be rejected.

[pavanpatil1]

Patch Tested: ​https://github.com/WordPress/wordpress-develop/pull/11439

Environment:

WordPress: v7.0 RC
PHP: 7.4
Playground

The patch is working fine. Usernames containing invalid characters (such as spaces or “www”) are rejected and able to register with correct username format ✅

Screenshots:

• Invalid username is not accepted: ​https://prnt.sc/s-LzXHdZ9FLI
• Registration email is sent successfully when a valid email is provided: ​https://prnt.sc/lvDBzEZzfY2K

[cweiske]

Thanks for the test.

Note that usernames with spaces can still be registered. Just usernames with "<space>www." are rejected, and those that begin with "www.".

[darshitrajyaguru97]

Patch Tested: ​https://github.com/WordPress/wordpress-develop/pull/11439

Environment

• WordPress: 7.0 RC
• PHP: 7.4
• Playground

Results

• Usernames containing invalid characters (such as spaces or restricted terms like "www") are correctly rejected.
• Registration works successfully with a valid username and email.
• Confirmation email is sent upon successful registration.

Summary

The patch is working as expected and resolves the issue effectively.

[minimoo]

On the basis that someone signing up should know the username they've entered (and also know their email) - wouldn't it be easier to continue to allow www. in a username - but just remove the username field from the email.

So the initial email just contains the link to set password.

I'm just imagining that someone may have made their username www.yyyy.com-admin or similar in the past, which then would no longer be valid after the wordpress update?

[SergeyBiryukov]

Hi there, thanks for the ticket!

Replying to minimoo:

I'm just imagining that someone may have made their username www.yyyy.com-admin or similar in the past, which then would no longer be valid after the wordpress update?

Indeed, we should be careful here, as both www. and spaces have been historically allowed in usernames.

Related: #59084

[cweiske]

I'm just imagining that someone may have made their username www.yyyy.com-admin or similar in the past, which then would no longer be valid after the wordpress update?

The username validation only affects user registration, not user login. I just verified this.

Existing users with usernames "www.example.org" or "admin of www.example.org" can continue to log in.

[johnbillion]

Moving to 7.0.1 for consideration. The password reset URL contains the username so I agree there's little need to include it in the email message text.

Doesn't do much to prevent the spam signups, but perhaps it'll deter them eventually.

[cweiske]

@johnbillion Is the current approach/patch moved to 7.0.1 for consideration, or only the topic?
Would you rather get a patch that removes the username? Would that be more qualified for 7.0.0?

When the username is removed, do you still deem it necessary to reject "www." in user names?

[jorbin]

The change to username validation is a no go, especially in a minor since that would be a breaking change, but I think @johnbillion's suggestion to remove the username from the email is potentially helpful. I do worry about the string change, so if we want to go that route a patch is needed soon.

Trac ticket:

## Use of AI Tools

[masteradhoc]

Hey @jorbin / @johnbillion

I've opened and tested a PR for this.

It removes the Username: %s line from the new user notification email sent to the user. The admin notification email is unchanged and still includes the username.

Thanks for checking!

[cbravobernal]

In 62590:

Notifications: Remove the username from the new user notification email.

Removes the username from the "Login Details" email sent to a user when their account is created (wp_new_user_notification()).

Props masteradhoc, cweiske.
Fixes #63085.

[cbravobernal]

Reopening for consideration for a 7.0.1 backport.

[NekoJonez]

Question, do new users now get an email with their details WITHOUT their username? How do new users know how to login then?

@cbravobernal

[wildworks]

Reopening for consideration for a 7.0.1 backport.

As I understand it, #62590 was not backported to 7.0.1. However, this issue should be fixed in 7.1, so I will close this ticket.