I'm the administrator of a Wordpress site, with just two users: me and one other user. Last days I've received multiple password recovery attempts for that other user (as an administrator I get a mail from the Wordfence security plugin). The other user gets the reset mail in his mailbox. The user didn't initiate these attempts.

I'm blocking the IP's on the server, but I don't see what the goal of the attacker is. I checked the mails the user receives, and they contain a valid password reset link (so no phishing attempt).

So I don't really understand what the attacker is trying to achieve with these password recovery requests. Or are they just checking for vulnerabilities on that page?

  • Or it's not an attack and they are getting their username/email wrong
    – schroeder
    Sep 7, 2020 at 15:07
  • The password recovery request is coming from a completely other part of the world as the client. He's not using any VPN or proxy, and confirms me he didn't initiate a password recovery request.
    – Coder14
    Sep 7, 2020 at 15:13
  • 2
    Right, I get that. But imagine I'm your user, but someone who created a username shroeder was (or thinks that they are) your user, but keeps trying to log in as schroeder. Now, they launch the password reset process and keep using schroeder. No attack, just a very confused person. Fun fact, my personal gmail account gets at least a dozen emails a week for people around the world because of this problem.
    – schroeder
    Sep 7, 2020 at 15:30
  • 1
    Or it's just a scanner that causes this in case the username is easy guessable (or enumerable)
    – Jeroen
    Sep 7, 2020 at 15:52
  • 1
    Clever trick I just made up: trigger lots of emails for recovering the user's password. Then send a phishing email like "Getting lots of password-recovery emails from our site? Turn them off from the admin panel at this link". The user might click, log-in to a fake admin panel, and turn off a fake option.
    – reed
    Sep 7, 2020 at 19:49

2 Answers 2


Hacker's often test password recovery systems for possible account enumeration weaknesses. Though a bad design decision or misconfiguration, a password recovery can reveal the existance of a user account. Then a list of valid user accounts can be used later in a brute force attack.

An attacker may test if there are different responses for valid and invalid usernames. They may record the time it took for the application to respond, to identify valid and invalid accounts.

Besides account enumeration, an attacker may test a password recovery for SQL Injection vulnerabilities. Can they insert malicious code server-side by crafting a SQL query in the password recovery username/e-mail field for example.

  • Just adding to the answer, an attacker may also trigger lots of password resets of multiple users with the intention of lowering the website's email score and landing their emails in the spam filter. Sep 9, 2020 at 16:19

There are three possible risks involved here. But before that, did you check to see if you ever received any e-mail from WordPress on account confirmation?

The first possible risk is, someone accessed (and may still have access to) your e-mail account and you never realized. This would be a possibility if the following two are true. First the account was originally created using your e-mail. Second, you cannot find the confirmation e-mail because someone had access to your e-mail, confirmed the account, then deleted the confirmation e-mail.

Second risk is not a risk for the e-mail account owner. The scenario in this second case is, someone may have changed the e-mail listed in their WordPress account, to your e-mail address by accident. The security risk here is not for you, it is a risk for the WordPress account owner. It could cause an issue if they make the same mistake again when changing their e-mail for their bank or credit card account. Then you would start receiving e-mails regarding their bank or credit card companies. You should contact WordPress regarding the issue and tell them the account you are getting the password recovery e-mails from is not yours.

The third possible risk is again a risk for the WordPress account owner and not you. The WordPress account owner may have accidently mistyped your e-mail address instead of theirs into the backup e-mail address, in their e-mail settings. They may only be using that e-mail account for WordPress only, and have selected forwarding a copy to back-up e-mail address, thus the reason why you are receiving the e-mails. The risk here is if they start using their e-mail account for purposes other than WordPress, where you then might start receiving their e-mails.

  • This is interesting, however not applicable to my situation. As the administrator, I receive a mail from Wordpress when a password reset is initiated. The user gets the password reset mail. I've added this info to the question.
    – Coder14
    Sep 9, 2020 at 8:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .