The Good_WordPress Leak: Just 38 Records, But Real Password Risk
On 1 January 2026, HEROIC analysts spotted a small combolist called "Good_WordPress" uploaded to a Telegram channel that trades in stolen login credentials. The file contained 38 records pairing an email address with a plaintext password and the URL of the account it opens.
Why This Is Dangerous
Small does not mean safe. Every password in this file is stored as plain, readable text, so anyone who grabs the file can use the credentials right away, often to try logging into WordPress-powered sites where the same login might have been reused.
What Was Exposed
- Email addresses
- Plaintext passwords
- URLs linking each credential pair to the site it belongs to
Why This Matters
A file labeled "Good_WordPress" suggests these are credentials that worked against WordPress site logins at the time they were collected. If any of the 38 accounts here reused that password on their email or another service, they remain exposed to takeover even though the list is small.
How Combolists Work
Combolists like this one are simple text files listing "email:password" pairs, often gathered from phishing pages, credential-stealing malware, or older breaches, then filtered by the site they work on before being shared or sold. Attackers use automated tools to test each pair against the target site, in this case likely WordPress admin logins, to find accounts they can take over.
Check If You Are Affected
Run a free scan against HEROIC's database of more than 400 billion leaked records to see if your email address shows up in this file or any other exposure, and change any password you may have reused.
Breach Breakdown
38 passwords exposed. Is yours one of them?
Enter your email to scan this breach plus 400B+ other leaked records. If you're compromised, we'll show you exactly where and what to change.
Free forever · No account required · Results in seconds
/img/qr-code.png)