Someone Has Your Password: 145 WordPress Logins Leaked

In April 2026, HEROIC discovered a stealer log file titled Good_WordPress being distributed on Telegram. The file contains 145 records—each one a WordPress admin credential set including an email address, a plaintext password, and the login URL. For every site owner whose credentials appear in this file, someone out there already has everything needed to walk into their WordPress dashboard and take control.

Your WordPress Password Is Fully Exposed

All 145 passwords in this dump are in plaintext. They are not hashed, not salted, not encrypted. They are the exact strings the site administrators typed, now visible to every threat actor who downloads this file from Telegram. There is no delay between an attacker finding this dump and attempting to log in—the credentials work immediately as-is.

What Was Exposed

• Email Addresses — WordPress admin account identifiers
• Plaintext Passwords — 145 unprotected login credentials
• URLs — the specific WordPress login pages for each compromised site

A Compromised WordPress Login Threatens Everything

WordPress admin access is not just another account. It means control over content, plugins, themes, user data, and potentially the underlying server. Attackers can inject malicious code, redirect visitors to phishing pages, install cryptocurrency miners, or use the compromised site as a launching pad for further attacks. Beyond WordPress, these 145 email-password pairs will be tested against other platforms through credential stuffing, threatening any service where the admin reused the same password.

The Malware That Built This List

Good_WordPress is a stealer log assembled by infostealer malware. These programs infiltrate devices through phishing links, pirated software, and drive-by downloads. Once active, they extract every saved credential from web browsers—including WordPress admin logins that site owners conveniently saved for quick access. The stolen data is organized by platform type and uploaded to Telegram, where attackers can easily search for specific kinds of high-value credentials like CMS admin panels.

Check If Your Credentials Were Exposed

Do not wait until your website is defaced or your visitors are redirected to malicious content. HEROIC's breach scanner indexes more than 400 billion compromised records. Search your email address or domain now to find out if your credentials were part of the Good_WordPress dump or any other known breach. If they were, change your WordPress admin password immediately, review your site for unauthorized changes, remove any unfamiliar user accounts, and enable two-factor authentication.