My own site has been opened even though I never tried it.

  • Unknown's avatar
    krhwan · Member ·

    OK. so I had made an account for Gravatar in 2015. Since then, I have lived normally as if I don’t know what gravatar is. And then today, I received 4 weird emails in a row at roughly 3PM and the titles were ‘Welcome to WordPress.com’, ‘Don’t forget to set these on your site!’ ‘One last thing for your site’, and ‘Our best tips for getting more people to your site’. They said I just joined WordPress and my website whose domain is freaking weird (like a two-year-old little cousin who didn’t eat breakfast tapped the keyboard mercilessly) has also been created. But what? I was even napping at that time. I was so confused but anyway accessed wordpress (which I’ve never heard about) immediately. Then I was already logged in even though I never have a recollection of signing up for this. More shockingly, my profile picture had been changed into full-body shot of a stupid afro-haired woman who wears nothing but red bikini sitting in dumbass deckchair. What happened? The service of Gravatar and WordPress has been united today? or is it just account hijacking?

    I don’t have a site with WordPress.com yet

  • Unknown's avatar
    justjennifer · Member ·

    There’s a Staff reply in this thread. https://wordpress.com/forums/topic/i-did-not-create-this/#post-3825705 They are currently investigating this issue.

    Thanks for the information about the changed Gravatar profile pic too.

    Your thread has also been flagged for Staff attention. Thanks for your patience.

  • Unknown's avatar
    krhwan · Member ·

    @justjennifer Appreciate ma’am.

  • staff-mckluskey · Staff ·

    Hi there!

    To log in to Gravatar, you use your WordPress.com account, so there is nothing to worry about. Now, the problem is that someone accessed your account and was able to create a spam website on your behalf.
    It’s possible that the password you used here was also used on another service that had a security breach. In those cases, we recommend changing the password on any website you used it.

    Additionally, here, on WordPress.com, make sure you also enable two-factor authentication:

    https://wordpress.com/support/security/two-step-authentication/.

    I have logged you out from any active sessions so, whoever had access to your account was logged off too.

  • The topic ‘My own site has been opened even though I never tried it.’ is closed to new replies.