Email when an Admin user is created ?

Hi,

We don’t have notifications for this, but we do have a feature in there called Security Admin which can actually prevent this from happening through the WordPress admin (it can’t currently preventing any modifications made directly to the database).

Try using the security admin system to prevent admin promotions by anyone except yourself.

Could you explain what you mean by the emails being sent differently and the queue you’re referring to? Shield uses the standard WordPress wp_mail() function like all other plugins and doesn’t do anything different to what is standard practice. If you’re having email deliverability issues, for whatever reason, then it’s likely you haven’t configured email delivery for your site domain – which is required if you want reliable email delivery. See here: https://onedollarplugin.com/blog/wordpress-email-deliverability/

Hi and thanks for the reply.

Would that “Security Admin” prevented the second admin created by YUZO Related security issue ?

About the emails. We use GD Mail Queue plugin and your emails are sent immediately, not using that plugin queue settings. It also shows in their header, they do not “pass” from the queue.

Hi,

I doubt that would have prevented it, but it depends on how the particular exploit that a hacker employs would work. We can’t say for sure, but I suspect that if the exploit could be engineered to use WordPress to promote a user to admin, or create an admin, our plugin would have blocked that. It simply blocks those activities unless the request taking those actions is both a WP admin, and is also authenticated with the security admin module. That vulnerability is caused by code that incorrectly identifies a request as ‘admin’-authenticated when it’s not. Our plugin would verify that independently.

Regarding the queue plugin, we don’t know how that plugin works and have frankly never heard of it. You will need to talk with them as to why, when Shield uses standard WP functions, their plugin isn’t queuing it. WordPress doesn’t have a mail queue, and so the developer of any 3rd party queue functionality will be the one to answer why Shield’s emails don’t go into their queue.

Hope that helps.
Paul.