I received this e-mail today:

From: WordPress.com
Subject: [WordPress.com] Password Reset

Someone has asked to reset the password for the following site and username.


Username: <my OpenID user name>

To reset your password visit the following address, otherwise just ignore this email and nothing will happen.

https://wordpress.com/wp-login.php?<blah blah blah>

The e-mail address it came to is one that I set up with gravatar.com when I created my awesome avatar1, and I haven't given this e-mail address to anybody else2.

I don't recall ever having visited WordPress.com, and I certainly haven't tried to reset a password there. In fact, the only time I read blogs is when they come up in a Google search of a problem I'm having. If this site uses OpenID (which I assume since the user name they mention is the one I use only for OpenID), why would they even have a password for me to reset?

So the common links are OpenID and Gravatar, both of which I've only used for StackOverflow and friends. Has anybody else seen something like this? Has my OpenID/Gravatar/StackOverflow (and friends) login been hijacked?

1. That's one of my incredible sons—my youngest—in a monkey costume for Halloween. He's very expressive.
2. I run my own mail server, so whenever I have to give my e-mail address to a site, I create an alias just for that site. That way, if I get any spam, I can drop that alias and I know that I can't trust that site.

  • I run my own mail server, so whenever I have to give my e-mail address to a site, I create an alias just for that site. That way, if I get any spam, I can drop that alias and I know that I can't trust that site. I used to use CJB aliases like that. The problem is that even if you cut the alias, that doesn’t stop them from sending the spam anyway, so you are still getting incoming traffic even if you simply discard it. ಠ_ಠ – Synetech Sep 22 '13 at 17:29
  • 1
    "Did you know that your Gravatar.com account has always been a WordPress.com account? It’s true." (blog.gravatar.com/2013/04/03/…) Yeah, I didn't know that either. Just got the rude awakening myself. – Cody Gray Jun 19 '14 at 7:03

EDIT, as precursor, in response to comments the questioner added below this answer:

You believe that you have never owned a WordPress.com account but it is a fact that, however it happened, you DO have a WordPress account. It is worth noting that WordPress has been around since 2005, you could have signed up ages ago, and you do need to a create account to get access to the Akismet service, which is used for many different types of blog and CMS.

You say that you only ever used the username contained in the email when signing up to receive an OpenID from myopenid.com but, for whatever reason, you have an account with that username at WordPress.com.

You say that the email was sent to a unique address that identifies it as being one you gave to Gravatar. Is it possible that this unique address actually refers to Automattic, the company that owns both WordPress.com and Gravatar, meaning that it might not actually be unique, that it might have been used at some point, which you now forget, to sign up to WordPress.com?

Regardless of exactly how it came about, the fact remains that you do have a WordPress account with that username and that email address, you should sign into the admin dashboard and check what date it was created, that might clear up the mystery.

Having established that you do own a WordPress.com account, my original answer still stands and I still believe that you have nothing to worry about:

It sounds as if this is related to an exploit uncovered in August, relating to your WordPress blog rather than OpenID, Gravatar or StackOverflow, and described here:

WordPress 2.8.4: Security Release

Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner. This doesn’t allow remote access, but it is very annoying.

So, a harmless annoyance at worst, as the email text you received says, "...just ignore this email and nothing will happen."

Obviously, the specific exploit described above has been patched, especially if you are using WordPress.com itself, but the fact that you have received the password reset email without requesting it sounds as if the haxors have taken a break from their packed schedule of furious, non-stop l33t masturbation and found another way to do the same thing.

I wouldn't worry about it, WordPress.com will no doubt be implementing a 2.8.5 security release within the next day or so.

It might be fruitful to spend the intervening hours asking yourself what impact forcing your youngest son to wear a monkey costume might have on his future life and career prospects.

  • I think he said that he didnt ever visit Wordpress. – akf Sep 4 '09 at 0:31
  • Yeah, I didn't even know what WordPress was, but LOL about the monkey costume. He actually asked to wear it (and still does), but he was grumpy about something (I don't remember what, exactly. Probably because we told him he had to take it off and get ready for bed.) – P Daddy Sep 4 '09 at 0:48
  • Well, by using WordPress as your OpenID provider (it is one the many options presented) you become a member of WordPress and get allocated a blog at <your OpenID user name>.wordpress.com, you can use your password to log into the administrative dashboard and start writing blog posts - there, you were a blogger and you didn't even know it :) – donnacha Sep 4 '09 at 1:12
  • I don't use WordPress as my OpenID provider. I didn't even realize such an option existed. When I created my SO account, I chose the first OpenID provider in the list: myopenid.com. – P Daddy Sep 4 '09 at 1:30
  • Okay, I have edited my answer to address that anomaly, I hope it helps. – donnacha Sep 4 '09 at 2:36
  • "WordPress has been around since 2005, you could have signed up ages ago" - No chance. Never heard of it, never heard of Akismet, and the e-mail address didn't exist until I set it up for Gravatar last year. "you should sign into the admin dashboard and check what date it was created" - Okay, I did. There are no dates that I can find anywhere in the dashboard. (cont.) – P Daddy Sep 4 '09 at 3:35
  • 1
    "Automattic, the company that owns both WordPress.com and Gravatar" - Aha! Now I think you're on to something. I'll bet Automattic took the liberty of creating this account at WordPress when I created one at Gravatar. I didn't know they were related. This probably means that the only foul play is the script kiddies mucking with people's passwords. – P Daddy Sep 4 '09 at 3:36
  • Of course, it's also possible that this is a ruse played by Automattic to increase interest in WordPress. It certainly brought them to my attention. – P Daddy Sep 4 '09 at 3:39
  • Hmmm, I guess that would solve the mystery but it would be pretty worrying and surprising if Automattic did that, they tend to be pretty ethical. Still, either way, it is good news that it probably just kids playing an annoying but ultimately harmless game and that they have no way of actually accessing or changing your password. BTW, if you think my answer answers your question, I'd really appreciate it if you could mark it as your accepted answer - I'm new here and enjoying the process of earning badges, this would be my first accepted answer :) – donnacha Sep 4 '09 at 3:45
  • No, not a ruse to promote WordPress, they are actually very embarrassed at having to have a series of security upgrades in rapid succession recently, they will be mortified if there is news of yet another. – donnacha Sep 4 '09 at 3:47
  • :) Enjoy your badge! – P Daddy Sep 4 '09 at 3:50
  • Thanks man, much appreciated, I'll put on my monkey costume to celebrate! Now I just have to cross my fingers and hope I get 6 more up-votes to get the badge - damn, this system is hard :) – donnacha Sep 4 '09 at 3:56

I think you should take this up with your OpenID provider.

  • myopenid.com doesn't have an e-mail address for me, so if anything, it would be Gravatar (or SO), but first I'd like to know for sure what it is I'm taking up with them. – P Daddy Sep 4 '09 at 0:46
  • They do request an email as part of the signup process: "Your e-mail address is optional, but providing it will let you recover your account if your sign-in information is lost or forgotten. We will never sell your e-mail address or send you spam." -- is it likely that you would have decided not to give them an email address, given the disadvantages of not doing so? – donnacha Sep 4 '09 at 2:47
  • I indeed did not give them an e-mail address. I just checked: "You do not have any e-mail addresses associated with this account." I keep an encrypted "password file", so I almost never have to do password resets. – P Daddy Sep 4 '09 at 3:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .