hi there,
same problem on multiple wp sites. No idea how they are created these types of users but i followed another approach with 2 interventions:
1. Created one simple plugin which blocks every attempt to login from other countries that is not mine.
2. Created a trigger on wp_users table which in case something with a login name is similar to wp_update-xxxx is inserted, then do not insert on the table…
this is not actually a solution because clearly they have a vector attack which for us is uknown but until a real solution is found, i stick with my workaround.
ps. The strange thing is that i have also a waf reverse proxy with owasp rules but yet they bypass it!
peace!
-
This reply was modified 8 months, 4 weeks ago by albgen.
