Credential Stuffing Attacks on WordPress: When Leaked Passwords Come Back to Haunt You

Table of Contents 5 sections

What Is Credential Stuffing?

Credential stuffing is an automated attack in which criminals take username and password pairs that leaked from one data breach and replay them against a completely different site. Because a large share of people reuse the same password across multiple accounts, a small percentage of those stolen credentials will unlock accounts on your WordPress site.

Unlike a brute force attack, which guesses passwords from scratch, credential stuffing already knows a real password. It simply hopes the same person used it on your site too. That makes it quieter, faster, and harder to detect.

How Credential Stuffing Works Against WordPress

1. A criminal obtains a list of leaked credentials from an unrelated breach. These lists contain billions of email and password pairs.
2. They load the list into an automated tool that rotates through thousands of proxy IP addresses to avoid simple blocking.
3. The tool sends login requests to /wp-login.php or the /xmlrpc.php endpoint, one credential pair at a time.
4. Most attempts fail, but a fraction succeed because the account owner reused a leaked password.
5. Successful logins are collected and either sold or used to inject spam, steal data, or install backdoors.

Why This Attack Is So Effective

• Password reuse is common. Many users protect their WordPress account with a password they also use for email or shopping sites.
• Low request volume per account. Because the attacker already has a valid password, they may only need one attempt, which slips under rate limits tuned for brute force.
• Distributed traffic. Requests arrive from thousands of IP addresses, so blocking a single address does little.
• Valid usernames are easy to find. WordPress author archives and the REST API can expose real usernames, giving attackers half of each credential pair for free.

How to Prevent Credential Stuffing

For Site Owners

1. Require two-factor authentication. This is the strongest defense. A stolen password is useless without the second factor.
2. Enforce unique, strong passwords. Encourage a password manager so no account shares a password with a breached service.
3. Check passwords against known breaches. Some security plugins block passwords that appear in public breach databases.
4. Add rate limiting and device fingerprinting. Slow down logins from unfamiliar devices even when the credentials look valid.
5. Hide usernames. Disable author archive enumeration and restrict the REST API users endpoint so attackers cannot harvest valid usernames.

For Developers

1. Disable XML-RPC if remote publishing is not needed, since it is a favorite endpoint for automated login abuse.
2. Add a CAPTCHA or proof of work challenge on the login form to raise the cost of automation.
3. Log and monitor failed logins with the source IP, and alert on unusual patterns.

How to Detect Credential Stuffing

Regular monitoring reveals the signs early. Watch for a surge in login attempts across many IP addresses, repeated failures against valid usernames, and logins from unexpected locations. Our WordPress Security Scanner flags exposed usernames, an open XML-RPC endpoint, and missing login protection so you can close these gaps before an attack succeeds.

Run a free scan on your site to check for these and other vulnerabilities.