What's the security risk in password recovery attempts

Question

I'm the administrator of a Wordpress site, with just two users: me and one other user. Last days I've received multiple password recovery attempts for that other user (as an administrator I get a mail from the Wordfence security plugin). The other user gets the reset mail in his mailbox. The user didn't initiate these attempts.

I'm blocking the IP's on the server, but I don't see what the goal of the attacker is. I checked the mails the user receives, and they contain a valid password reset link (so no phishing attempt).

So I don't really understand what the attacker is trying to achieve with these password recovery requests. Or are they just checking for vulnerabilities on that page?

Answer 1

Hacker's often test password recovery systems for possible account enumeration weaknesses. Though a bad design decision or misconfiguration, a password recovery can reveal the existance of a user account. Then a list of valid user accounts can be used later in a brute force attack.

An attacker may test if there are different responses for valid and invalid usernames. They may record the time it took for the application to respond, to identify valid and invalid accounts.

Besides account enumeration, an attacker may test a password recovery for SQL Injection vulnerabilities. Can they insert malicious code server-side by crafting a SQL query in the password recovery username/e-mail field for example.

Answer 2

There are three possible risks involved here. But before that, did you check to see if you ever received any e-mail from WordPress on account confirmation?

The first possible risk is, someone accessed (and may still have access to) your e-mail account and you never realized. This would be a possibility if the following two are true. First the account was originally created using your e-mail. Second, you cannot find the confirmation e-mail because someone had access to your e-mail, confirmed the account, then deleted the confirmation e-mail.

Second risk is not a risk for the e-mail account owner. The scenario in this second case is, someone may have changed the e-mail listed in their WordPress account, to your e-mail address by accident. The security risk here is not for you, it is a risk for the WordPress account owner. It could cause an issue if they make the same mistake again when changing their e-mail for their bank or credit card account. Then you would start receiving e-mails regarding their bank or credit card companies. You should contact WordPress regarding the issue and tell them the account you are getting the password recovery e-mails from is not yours.

The third possible risk is again a risk for the WordPress account owner and not you. The WordPress account owner may have accidently mistyped your e-mail address instead of theirs into the backup e-mail address, in their e-mail settings. They may only be using that e-mail account for WordPress only, and have selected forwarding a copy to back-up e-mail address, thus the reason why you are receiving the e-mails. The risk here is if they start using their e-mail account for purposes other than WordPress, where you then might start receiving their e-mails.