0

I just updated my site to 3.6.4 and in doing some maintenance noticed that there were unauthorized users added to the site to the registered users group. I was able to delete the users without a problem, some were obviously spammers, some with domain name suffixes coming from eastern Europe.

Do I need to worry about what I registered user could do with privilege escalation? should I change all the server passwords? I've read that the 3.6.4 update was specifically to fix a privilege escalation exploit, but what else should I do?

|improve this question
  • From the pattern, I believe they are just regular spammers, but changing your credentials (user/server passwords) regularly is one of the most effective way to prevent potentials security problems. – webchun Nov 10 '16 at 12:16
0

The user escalation problem is fixed on 3.6.4, so, if you are using this version, you shouldn't have this problem.

Nevertheless, I suggest you disable user registration on your website. This is explained here. If you do need user registration on the frontend of your website, then make sure that only an administrator is able to activate these accounts.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.