The Good_WordPress Leak Targeted 35 Site Admin Logins Directly

HEROIC analysts identified a small combolist uploaded to Telegram in late July 2026, named "Good_WordPress." The file contains 35 records, each pairing an email address with a plaintext password and a URL, all apparently tied to WordPress site logins.

Why the Good_WordPress Leak Is Dangerous

WordPress powers a huge share of websites on the internet, and admin access to a WordPress site means the ability to edit content, install plugins, or redirect visitors to malicious pages. Even with just 35 credentials in this file, each one represents a working door into someone's website, not just a single account.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the WordPress login pages

Why This Matters

A compromised WordPress login can let an attacker plant malware on a site, steal visitor data, or use the site's reputation to send phishing emails. Because these 35 credentials are labeled "good," meaning the uploader believes they still work, the risk to the site owners in this file is immediate rather than theoretical.

How a Small WordPress Combolist Like This Gets Made

Attackers often target WordPress specifically by scanning the internet for login pages, then attempting common or previously leaked passwords against them, or by using phishing pages that mimic the WordPress admin login screen. Once a batch of working credentials is confirmed, they get labeled "good" and packaged into a small, focused combolist like this one before being shared on Telegram.

Check If You Are Affected

If you manage a WordPress site, it's worth checking whether your login is part of this leak. HEROIC's free breach scanner compares your email against more than 400 billion leaked records, including this combolist, so you can update your password before someone else logs into your site.