Vulnerability – fake accounts created even though no signup option + phishing

Hi – I have a Newspaper license for my website for over 5 years now: cricexec.com

Recently we had a phishing attack, we believe due to a vulnerability in the theme.

This is a different issue from the known Balada issue, because we have Tagdiv 4.8 installed and the issue here wasn’t redirection.

The issue is this: we have removed the user registration/signup prompt from the website — because we don’t want just anybody to be able to create an account.

However, there are still thousands of spam accounts being created somehow (all “subscriber” accounts). We keep deleting them and they keep coming back. For example just yesterday there were 7,000 spam accounts we deleted.

And even after that, overnight dozens have been created.

One of these spam accounts recently launched a phishing attack, which we had to deal with.

The question is this: if we are not making signup visible, how are hackers able to create WordPress user accounts on our site? And how can this be blocked?

If you have a create account form in any normal place that is default in WordPress and not sandboxed in some way then anybody can create an account as subscriber.
(e.g., http://yourdomain/wp-login.php?action=register )
a) open the WordPress dashboard and click Settings » General. Find the Membership setting and uncheck Anyone Can Register.
b) use Akisment to block known bots on forms
c) use hCaptcha / recaptcha on any forms
d) if you use server side reporting, look for the IP(s) hitting your site 7,000 times and block at hosting level or via htaccess, firewall etc.

(I don’t work here; just long time WP and TagDiv user.)

Thanks so much Chris! Will give all of these a shot, hopefully (a) by itself will solve our problem.