Hi @miguelappstudio
I hope you’re well today!
What you described suggests that those registrations are bypassing the standard registration “path” which makes things a bit more complex.
Defender can help protect the site but, like any other security plugin, it’s a plugin only – meaning it works “within” the environment which it protects and that creates some limitations of what can and cannot be monitored.
I would say that those registrations are most likely coming in one of the three ways:
a) there may be some custom registration from (added by theme or some other plugin) that doesn’t hook to WordPress core in “standard” ways; it’s rare but I’ve seen it a few times in the past (especially with some older plugins) where the registration was all custom coded in a way that “bypasses” WordPress core in which case it would also be able to bypass most of security plugins
b) there may be a vulnerability in theme or one of the plugin that makes it possible; if it’s already known or is due to some malware infection; Defender’s free malware scan could possibly detect malware infection by finding files that appear to be modified but the free version doesn’t check for vulnerabilities, I’m afraid.
c) another possible way (though if you are getting e-mail notifications, it doesn’t sound like it’s the case here) would be direct injection to the DB e.g. due to compromised DB access credentials
An alternative and quite likely way is that there is some compromised admin-role account on the site. In such case there wouldn’t really be any vulnerability or infection but simply an attacker (maybe a human or maybe just a bot) would use that account to login and, as admin, they’d be able to just add new users from back-end even if regular registration is fully protected and/or disabled – because admins are always able to do this.
——
So aside of what was suggested earlier, I would recommend following additional steps:
– triple-check all accounts on site that have admin roles and make sure that there are no “abandoned” or “unrecognizable” ones; for those that you are sure are legitimate – make sure that “Pwned Passwords” option is enabled in Defender and then force password reset (you can use Defender for that too on “Defender -> Tools” page)
– if possible, do change DB password in hosting and then update wp-config.php file accordingly
– review the plugins to make sure that a) there are no unnecessary plugins there (for example, plugins that you no longer use or are really not essential to the site) and b) that everything is fully up to date
– consider enabling 2FA for users or at least admins; there’s a chance that a compromised account user may not be able to configure it (especially if it’s a bot)
– enable login protection option in Defender’s firewall as it may help preventing any attacks that attempt to “guess” or “dictionary break” passwords to user accounts
Best regards,
Adam
