There is a Wordpress blog running on Wordpress 4.0. Anyone having the company webmail can signup to the blog using their Google+ account and submit blog posts. Once posted they will be sent to some moderators and once it is reviewed moderator can post it on the blog. Whenever anew blog post is submitted for review all the moderators will receive a mail saying to review the post.
Now the problem: The moderators are receiving spam mails. Mail says that there is a new blog post to be reviewed. To review goto this link. The link is a normal link. Nothing seems fishy. But the author details are interesting. The authors are not members of the organization and hence they can't create blog posts. So that I cant think of this as a simple spamming trick. How such moderator mails are getting generated?
The authors had an email addresses like email@example.com and firstname.lastname@example.org. What am I supposed to do? Am I hacked?
The emails are being received from registered mail server and the link looks like a normal edit blog post link. But since there are no such real blog post it redirects to the blogs homepage.
Recently I have deleted all the unwanted users from the website and watched the new users carefully. Within 4 days new spam users are getting registered to the site. Around 100 users were registered in 4 days.
I have the
New user registration feature disabled. Still how this happens?