Today automatically added two admins to my site?
Is my site hacked?
What should I do to fix this bug?


2 Answers 2

  • First of all, remove the new admin users and change the password for the main admin user (and other admin users if there are any)
  • Change the password of MySQL and update it in the app/etc/local.xml file.
  • Change the password for the hosting panel and the MySQL management tool.
  • Scan your store for the security patches (with the help of https://www.magereport.com/) and install if any patch is missing from the store.
  • Magento provides a scan facility for stores to help the merchants keep their websites safe. Register yourself on https://magento.com/security and scan your website.

Note: Don't share your secret credentials over a non-secure medium and change them regularly.

I hope it would help.

  • 1
    Unfortunately, this did not happen due to not updating it. Your work was more security-related and I did **thank you ** But by updating, I thought I'd fix this bug Commented May 1, 2019 at 9:17
  • why the downvote? Commented May 1, 2019 at 10:19
  • 1
    I gave you a positive vote Commented May 1, 2019 at 11:35
  • Thanks, but someone else has downvoted. Commented May 1, 2019 at 11:37

If you've got this problem, be sure to install the 8788 patch or update your shop.
This patch prevents attackers to create an admin account and execute code

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.