I recently changed an admin user email on a WordPress site that I manage. I used the same email address for the settings field within WP Admin. The new email address is completely unique and is not used anywhere else online.

Several hours after the changes were made, I received a series of spam emails.

How is this email being leaked and how can I lock it down?

  • 1
    There are a hundred different ways this could happen, and they might not be related to WordPress at all. – schroeder Nov 17 '18 at 14:01
  • You're right. There are multiple things to consider here like plugins, theme, and website hosting setup. – Sam Nov 18 '18 at 9:02
  • 1
    The WP API leaks MD5 hashes of the email addresses of users. See /wp-json/wp/v2/users – Daniel Ruf Nov 18 '18 at 14:16
  • Nice spot. Just googled from your comment and found this: hackerone.com/reports/356047. – Sam Nov 18 '18 at 22:17

Browse other questions tagged or ask your own question.