I recently looked at the tags for my WP site and saw dozens of tags which I didn't add, and which seemed unrelated to any posts I've ever made. Many of them looked like random dictionary words. A handful of them had descriptions and a google search for the exact description text brings up many sites with the exact same tags, e.g. "8bit", "Mothership", "Nailed It", etc.

My question: how and by whom where these tags added? Are they installed by default by some plugin? Are they evidence of a vulnerability?

google search of example tag

I recently looked at the tags for my WP site and saw dozens of tags which I didn't add, and which seemed unrelated to any posts I've ever made. Many of them looked like random dictionary words. A handful of them had descriptions and a google search for the exact description text brings up many sites with the exact same tags, e.g. "8bit", "Mothership", "Nailed It", etc.

My question: how and by whom where these tags added? Are they installed by default by some plugin? Are they evidence of a vulnerability?

google search of example tag

• tags

• 2 If there's content on your site that you didn't add, and you're not using a plugin to automatically generate tags, then yes, your site probably has been compromised. Whether it was a WordPress, plugin, or theme vulnerability, or your password was guessed or stolen, is impossible to say. The best thing to do is follow the 'my site was hacked' FAQ: wordpress/support/article/faq-my-site-was-hacked – Jacob Peattie Commented May 4, 2020 at 14:44
• 1 I should have search github first: github search Looks like these tags are added as part of unit tests for the json-api plugin... backing off of the ledge. – cmcnulty Commented May 4, 2020 at 16:44
• 1 Please expand your comment into an answer...I imagine many WP admins would be stumped to find this happening to their installation. The Github search link doesn't work without a Github account btw. – Jos Commented May 5, 2020 at 10:16

1 Answer 1

The answer is that these tags are created as part of the unit-test suite of json-api WP plugin:

https://github/dphiffer/wp-json-api

https://wordpress/plugins/json-api/