Wordpress blog hacked?

Question

There is a Wordpress blog running on Wordpress 4.0. Anyone having the company webmail can signup to the blog using their Google+ account and submit blog posts. Once posted they will be sent to some moderators and once it is reviewed moderator can post it on the blog. Whenever anew blog post is submitted for review all the moderators will receive a mail saying to review the post.

Now the problem: The moderators are receiving spam mails. Mail says that there is a new blog post to be reviewed. To review goto this link. The link is a normal link. Nothing seems fishy. But the author details are interesting. The authors are not members of the organization and hence they can't create blog posts. So that I cant think of this as a simple spamming trick. How such moderator mails are getting generated?

The authors had an email addresses like name@h.maybebest.com and name@nokiamail.com. What am I supposed to do? Am I hacked?

EDIT

The emails are being received from registered mail server and the link looks like a normal edit blog post link. But since there are no such real blog post it redirects to the blogs homepage.

Recently I have deleted all the unwanted users from the website and watched the new users carefully. Within 4 days new spam users are getting registered to the site. Around 100 users were registered in 4 days.

I have the New user registration feature disabled. Still how this happens?

Answer 1

I'm assuming there is no relation between these mails and any actual new posts to be reviewed, right? I.e., just be cause you receive one of these mails, there does not need to actually be a new blog post to review?

If this is the case, then I can't see any indication of any relation between these mails and your systems (the WP system). In other words, I can't see any reason to view this as anything other than "regular" spam.

As for the links, the fact that they point to your moderation page does not mean an attacker has access to your site`s internals - the url is probably just a standard url for WP sites, with the root url replaced with your site's address.

Edit: As mentioned in the comments below, the real issue is that the mails appear to be coming from the internal mail-server. This could perhaps indicate a breach (?), but should be verified by checking logs for the mail server to make sure the mails are not just manipulated to look as if they're from your server. If logging is not turned on, change that now, and check the logs next time such a mail is received.

(Sidenote: Why would someone do this? Perhaps as a way to try to bypass any mail-filtering system you have in place, in order to sneak in spam that would otherwise be stopped?)

Answer 2

I don't have a specific answer for you, but if you search for "Wordpress hacked" you will begin to get an idea of the scope of the problem you face. My anecdotal experience is that Wordpress plugins tend to be responsible for a lot of the hacking that goes on, so I would start by patching your software stack from the OS up to Wordpress plugins and then looking at each of your installed plugins for known security holes. Someone is obviously getting into your Wordpress admin or user database through a security hole. Your challenge is finding and plugging the hole.