I have a multi-site, multi-network configuration. I have disabled registration in the general WordPress settings. However, internet attackers are still able to create spam accounts by hitting this url:
/sitepath/wp-admin/admin-ajax.php?td_theme_name=Newsmag&v=5.4.3.5
with a payload of
action=td_mod_register&email=foo%40bar.com&user=qoFZLEvvQbYvadOZFR&pass=
Hi,
Please make sure that you are using CloudFlare and Wordfence to be sure that your site is protected by bots.
After that, make sure that you have set the reCAPTCHA by Google in the theme panel – https://prnt.sc/Qm2F72H915Lb
Thank you!
Thank you for your reply.
However, your response is not adequate given the seriousness of the issue that was reported.
The problem I described is not a general bot protection matter. It appears to be a flaw in the way your plugin handles account creation and/or validation. If a plugin allows attackers to bypass WordPress settings and create accounts, that is a defect in the plugin’s logic. It is not acceptable to shift responsibility to users by instructing them to deploy Cloudflare, Wordfence, or reCAPTCHA as compensating controls.
Security controls such as firewalls and CAPTCHA are defense-in-depth measures. They are not substitutes for correct server-side validation and adherence to WordPress core security mechanisms. A plugin must function securely in a standard WordPress environment without requiring users to re-architect their network, introduce third-party services, or alter user experience flows to compensate for insecure code paths.
Recommending Cloudflare and Wordfence does not address the root cause. It avoids the core issue: your plugin is bypassing expected WordPress restrictions and enabling unauthorized account creation.
If the plugin modifies or overrides WordPress registration logic, that logic must include proper nonce validation, capability checks, and server-side enforcement of the site’s registration settings. Anything less is a security vulnerability.
I am asking you to:
- Acknowledge whether the behavior described is reproducible.
- Confirm whether the plugin bypasses native WordPress registration restrictions.
- Clarify whether a patch will be issued to correct this behavior.
This is a security concern, not a configuration preference. It should be handled as such.
I look forward to your technical response.
Hi,
I would like to clarify that a standard WordPress installation, even when using the theme, does not automatically block bots. WordPress securely handles login, registration settings, and user roles, but it does not include built-in bot protection such as CAPTCHA or rate limiting by default.
This means that any public form (login, registration, contact form) can be targeted by automated bots unless additional protection is enabled.
The theme does not bypass WordPress registration settings. It follows the normal WordPress rules. To reduce automated registrations or spam, the theme provides an option to enable reCAPTCHA (Use Google reCAPTCHA v3 or Use Google reCAPTCHA global domain) as an extra security layer.
If you can share clear steps showing that WordPress registration settings are being bypassed, we will be happy to review and investigate further.
