A user has an easily guessed password

What Wordfence found

The password audit hashes candidate passwords from known-weak and breached lists and compares them against the stored hashes. A match means that account's password is one an attacker will try early.

Why it matters

Credential stuffing does not need a vulnerability. If the password is in a public list, the account is effectively open, and an administrator account is a complete compromise. The severity depends almost entirely on the role.

How to fix it

1. 1Force a password reset for the affected account rather than emailing them a suggestion.
2. 2Turn on two-factor authentication for every administrator and editor. This is the single highest-value change on the list.
3. 3Set a password policy that rejects breached passwords at the point of change.
4. 4Review whether the account needs its current role at all — most people given administrator do not need it.

Findings that often appear with this one

• An administrator was created outside WordPress Login
• wp-config.php is readable over the web Public files

How WPSecureOps treats it

The connector reports this as easyPassword. WPSecureOps files it under Login and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.