Wordpress Alert: Unauthorized user creation

What it looks like

A registration or import action creates accounts without the intended authorization.

Why it matters

Attackers may create access paths or hidden administrators.

What to check

Review recent accounts and require capability checks on administrative creation routes.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WordPress roles and capabilities.