A WordPress site that had been migrated to Freshy began showing unusual activity: a large number of unauthorized subscriber accounts (many using Gmail and Yahoo addresses) were appearing, and one had even managed to upload an image. Upon review, Freshy’s support team discovered several vulnerabilities in the site’s configuration, including outdated plugins and theme files.
This guide outlines how our team identified the problem, secured the site, and implemented best practices to prevent unauthorized account creation and file uploads on WordPress sites.
Issue background
The affected WordPress site was found to have dozens of unauthorized “subscriber” accounts being automatically created. One of these users was even able to upload an image, which indicated that permissions for the subscriber role were not properly restricted.
The site’s setup included the Avada theme and several popular plugins:
- Custom Post Type UI
- Directorist – Business Directory Plugin
- FileBird Pro
- GTranslate
- Slider Revolution
- The Events Calendar
- Wicked Folders
- WP Rocket
Several of these plugins were outdated, and the installed version of Avada Fusion Builder (3.11.14) contained a known vulnerability that could allow attackers to create accounts or inject data.
Diagnosis
Freshy developers conducted a detailed security audit to pinpoint the issue and its potential causes:
- User audit – Reviewed all accounts in
/wp-admin/users.phpto identify unauthorized subscribers and confirm the legitimacy of admin-level users. - Role capabilities check – Created a test subscriber to verify that users with this role couldn’t upload media or perform actions beyond their permissions.
- Plugin and theme review – Scanned for outdated and vulnerable plugins and themes.
- Form inspection – Identified an unused Gravity Forms upload field that could allow file uploads from front-end users.
- Security settings review – Checked XML-RPC and registration settings for potential misuse or exposure.
The open registration setting, outdated builder plugin, and unused upload field collectively created opportunities for unauthorized access.
Resolution steps
To secure the site, the Freshy team implemented the following measures:
- Disabled user registration
In Settings > General, unchecked “Anyone can register.” This prevented new user accounts from being automatically created. - Removed unauthorized users
Deleted all unknown subscribers and verified the remaining users. Ensured that only approved team members held admin privileges. - Restricted file uploads
Confirmed that only users with higher roles (Editors, Administrators) had theupload_filescapability. Recommended using the User Role Editor plugin for clearer role management and permission control. - Updated all plugins and themes
Updated the Avada theme and all plugins to their latest versions. Verified that updates did not cause conflicts or errors on the staging environment before pushing them live. - Secured file upload forms
Limited Gravity Forms upload fields to.pdfand.docfile types and set upload limits. Disabled unused forms containing upload functionality. - Verified XML-RPC security
Confirmed with the hosting provider (Pressable) that XML-RPC was protected through their Web Application Firewall (WAF), ensuring no additional exposure. - Validated essential functionality
Confirmed that the “Hospital Doctor Directory New” plugin, which powers the site’s provider listings, was legitimate and functioning as intended.
Final outcome
- All unauthorized user accounts were removed.
- Plugins and themes were fully updated and secured.
- File uploads and registration settings were properly restricted.
- The site continues to operate securely under managed maintenance and hosting.
Keep your WordPress site secure
Unauthorized account creation often stems from outdated software, open registration settings, or misconfigured permissions. Regular updates, role audits, and form reviews are key to preventing exploits and maintaining site security.
If you’d like to review your WordPress user permissions or ensure your site is properly secured, contact Freshy for a comprehensive WordPress security audit.
