I recently changed an admin user email on a WordPress site that I manage. I used the same email address for the settings field within WP Admin. The new email address is completely unique and is not used anywhere else online.

Several hours after the changes were made, I received a series of spam emails.

How is this email being leaked and how can I lock it down?

closed as primarily opinion-based by schroeder Nov 17 '18 at 14:01

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    There are a hundred different ways this could happen, and they might not be related to WordPress at all. – schroeder Nov 17 '18 at 14:01
  • You're right. There are multiple things to consider here like plugins, theme, and website hosting setup. – Sam Nov 18 '18 at 9:02
  • 1
    The WP API leaks MD5 hashes of the email addresses of users. See /wp-json/wp/v2/users – Daniel Ruf Nov 18 '18 at 14:16
  • Nice spot. Just googled from your comment and found this: hackerone.com/reports/356047. – Sam Nov 18 '18 at 22:17

Browse other questions tagged or ask your own question.