wadminw user suddenly added to 36 separate sites this morning with the email [email protected]

[ad_1]

Is anyone else seeing this today too? I did a quick google search but didn’t find anything helpful. The user was added to all of the sites within a ~10 minute window of 9:50am to 10am ET.

I’ll be doing a deep dive into plugins that these sites have in common and looking at the site’s audit logs and the server logs.