No idea what happened, but the end user was having issues with his computer and somehow it was hanging on to those cookies. Since they weren’t expired, nothing we did to remove them did a lot of good but getting the end user to clear cookies/cache resolved the issue.
I’d love to know more about the internals of how WordPress handles this, but for now at least the issue is gone! I don’t think there’s anything we could’ve done inside WordPress to prevent this though.
Related Posts:
- Handling nonces for actions from guests to logged-in users
- Session Cookie security questions
- How to redirect all HTTP requests to HTTPS
- What’s the best approach for generating a new API key?
- Simplest two-way encryption using PHP
- How does the SQL injection from the “Bobby Tables” XKCD comic work?
- how fix “this certificate cannot be verified up to a trusted certification authority”
- How can bcrypt have built-in salts?
- Getting a List of Currently Available Roles on a WordPress Site?
- What’s the easiest way to stop WP from ever logging me out
- How safe / sanitized is wp_insert_posts()?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- Why are passwords exportable as plain text in WordPress?
- What’s the difference between esc_* functions?
- How to set up fail2ban with WordFence?
- Is there a way to force ssl on certain pages
- What is the purpose of having a token in cookies?
- How to remove “Connection Information” requirement on localhost install of WP on MACOSX
- How is password strength calculated?
- Regular security checks – what steps should be included?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- WordPress “Site Health Status” trust it or myself for its security advice?
- Do Cookies Need to be Sanatized Before Being Saved?
- Is WP vulnerable when updating plugins or themes?
- Disable external access to REST API Endpoint
- What is the wp-includes/certificates/ca-bundle.crt used for?
- Do you need to escape hard coded plain text?
- Encrypt emails?
- Garbage in beginning of wp-config.php – was this WP installation compromised?
- WordPress salts set in config and database
- Disallow file edit not preventing plugin install
- How to secure WordPress XMLRPC?
- What is the relationship between cURL, WordPress and cacert.pem?
- How can I find security hole in my wordpress site?
- Does WP show me if I’m logged in from multiple locations?
- How to prevent bot or someone to modify any file automatically?
- HTTP Security Headers in wp-config
- WordPress Malware Problem help! [duplicate]
- Best Way to Enable Two Step Authentication
- Restrictive File Permissions
- Why are xmlrpc.php and wp-cron.php being called so often?
- Using esc_html with HTML purifier and CSSTidy: Overkill?
- wordfence scan warning on W3 Total Cache [closed]
- Securing a multi-user permission structure
- Is default functions like update_post_meta safe to use user inputs?
- wp-config.php modified?
- Securing wp-config leads to sensitive information leak on wp-settings
- Suspicious Files
- What’s the point of forbidding access to wp-config.php?
- How to save iframe tag into a post?
- neccessary?
- my wordpress website is suspended [closed]
- Is wp_kses the right approach in sanitizing this string?
- XMLRPC slow and weird websites/services
- iTheme Security always lockout my account [closed]
- Is it sensible to worry about sanitizing admin input in plugin custom CSS?
- WordPress Front end Form – Enable to Submit PHP Codes
- Is it safe to hand over the admin rights?
- Is it safe use wp_editor in public contact form
- Is WordPress MultiSite secure & how much can it scale? [closed]
- How to find exploited wordpress plugin [closed]
- How I can open back door for myself?
- How safe is current_user_can()?
- Is it safe to give wordpress directories ownership to www-data?
- How can I force a specific password?
- Do we need to escape data that we receive from theme options?
- Why does WordPress change a file’s permissions?
- Side effects of disallowing *.php requests in production environment?
- Outgoing new connection to linked Websites – why?
- My Site keeps crashing due to the wp-confg file being deleted
- Someone keeps changing my SITEURL (mysql injection or xss?) [closed]
- Who updates the wp-admin/core file?
- How WordPress sanitizes post content on save? Or it doesn’t?
- Replace domain in database
- Does this code indicate an exploit?
- What highest security brake with wordpress and static files?
- Spam in WordPress root folder
- Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?
- HSTS header not being added correctly
- Can WordPress admin user + database credentials be used to gain Cpanel or FTP access?
- Should I worry about SQL injection when using REST API?
- Links to root domain from search engines don’t work, but direct links and links from other referrers do
- How can I backup my site if it gets hacked?
- Cannot access wp admin of WordPress website (security plugin issue) [closed]
- Why are the latest visits to my website originating from my own website?
- Secure Multiple WordPress Installations on shared hosting
- How do I hide WordPress users from security scanning?
- Background Updates Not Happening
- wp-config.php file and code injection
- Able to go to WordPress admin even after deleting auth cookies from request headers
- FORCE_SSL_ADMIN affecting subdomains
- What is the best security $_POST method?
- Is WordPress ready for GDPR compliance? [closed]
- Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
- Bank account number and Sort Code in a form [closed]
- checking the form submit in right order
- SSH keypair generation: RSA or DSA?
- How do I protect my company from my IT guy? [closed]
- Does changing default port number actually increase security? [closed]
- WordPress – tracking options