13,539 Plaintext Passwords From WordPress Sites Just Hit Telegram

HEROIC analysts detected a massive stealer log targeting WordPress users that was uploaded to a public Telegram channel on June 4, 2026. The file contains 13,539 records, each exposing an email address, a plaintext password, and the specific WordPress login URL where the credentials were used. This is among the larger WordPress-focused credential dumps to surface on Telegram in recent months.

WordPress powers over 40% of all websites on the internet, making these credentials exceptionally valuable to attackers. The exposed records likely include a mix of WordPress site administrators, editors, and registered users across thousands of different websites. With plaintext passwords and exact login URLs in hand, attackers have everything they need to access these WordPress installations directly.

Why Plaintext WordPress Passwords Are Especially Dangerous

The passwords in this dataset are not hashed, salted, or encrypted in any way. They appear exactly as each user typed them, ready for immediate use. For WordPress credentials specifically, this is a critical concern because a compromised administrator account grants full control over an entire website — including the ability to inject malicious code, deface pages, steal customer data, or install backdoors for persistent access.

Even non-admin accounts pose serious risks. Compromised editor or author accounts can be used to publish phishing content, distribute malware through legitimate-looking pages, or pivot deeper into the WordPress installation by exploiting privilege escalation vulnerabilities. The plaintext nature of these credentials means none of these attacks require any technical sophistication to execute.

What Was Exposed in the WordPress Dump

• Email Addresses — Email addresses associated with WordPress user accounts, which often serve as the administrator contact for websites and can be used to initiate password resets on other platforms.
• Plaintext Passwords — Unencrypted passwords captured from browsers and password managers on infected devices, giving attackers direct login access without any cracking or decryption step.
• URLs — WordPress login page addresses (typically wp-login.php or wp-admin paths) revealing the exact sites where these credentials grant access, effectively providing a target list for mass exploitation.

Why 13,539 WordPress Credentials Threaten the Entire Web Ecosystem

The sheer volume of this dump creates systemic risk. Each compromised WordPress site can be weaponized to attack its visitors through malicious redirects, drive-by downloads, or SEO spam injections. A single hijacked website can infect thousands of visitors before the compromise is detected, creating a cascading chain of damage that extends far beyond the original credential theft.

Password reuse amplifies this threat further. Website administrators who use the same credentials for their WordPress dashboard, hosting control panel, domain registrar, and email account risk losing control of their entire web infrastructure from a single compromised password. Credential stuffing tools can test all 13,539 pairs against popular hosting providers and domain registrars in a matter of hours.

How Stealer Logs Compromise Website Owners at Scale

This dataset was not produced by attacking WordPress servers directly. Instead, infostealer malware on individual users' devices captured credentials as victims logged into their WordPress dashboards. The malware extracted saved passwords from browser credential stores, intercepted form submissions during active login sessions, and harvested session cookies that could allow attackers to bypass authentication entirely.

The collected data was organized into a structured log and uploaded to Telegram, where it became accessible to anyone monitoring stealer log distribution channels. This supply chain — from endpoint infection to Telegram distribution — has become the dominant pipeline for stolen credential distribution, and WordPress sites are a frequent target due to their prevalence and the high value of admin-level access.

Check If Your WordPress Credentials Are in This Leak

If you manage a WordPress website or have user accounts on WordPress-powered sites, check your exposure immediately. HEROIC offers a free breach scanner that searches over 400 billion compromised records, including stealer log datasets like this WordPress-targeted dump.

Search your email address to determine whether your credentials appear in this or any other breach. If you find a match, change your WordPress password immediately, rotate passwords for your hosting account and domain registrar, review your site for unauthorized changes or unfamiliar user accounts, enable two-factor authentication on your WordPress dashboard, and scan all devices you use for site management with current antimalware tools.