Today automatically added two admins to my site?
Is my site hacked?
What should I do to fix this bug?

  • First of all, remove the new admin users and change the password for the main admin user (and other admin users if there are any)
  • Change the password of MySQL and update it in the app/etc/local.xml file.
  • Change the password for the hosting panel and the MySQL management tool.
  • Scan your store for the security patches (with the help of https://www.magereport.com/) and install if any patch is missing from the store.
  • Magento provides a scan facility for stores to help the merchants keep their websites safe. Register yourself on https://magento.com/security and scan your website.

Note: Don't share your secret credentials over a non-secure medium and change them regularly.

I hope it would help.

| improve this answer | |
  • 1
    Unfortunately, this did not happen due to not updating it. Your work was more security-related and I did **thank you ** But by updating, I thought I'd fix this bug – user3485709 May 1 '19 at 9:17
  • why the downvote? – Mohit Kumar Arora May 1 '19 at 10:19
  • 1
    I gave you a positive vote – user3485709 May 1 '19 at 11:35
  • Thanks, but someone else has downvoted. – Mohit Kumar Arora May 1 '19 at 11:37

If you've got this problem, be sure to install the 8788 patch or update your shop.
This patch prevents attackers to create an admin account and execute code

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.