Updated wordpress to 6.2 wasn’t far behind maybe 3 months

user called and said emails on pages were off

contact@domain.com

became

contact@www.domain.com

Every Page on a lot of pages

worse is all user accounts were also tweaked…
not sure if it was a plugin or site update - highly suspicious of a plugin like link checker

But editing the user account emails is the part confusing me…

8 Spice ups

It probably wen throughout all the databases and replaced domain.com with www.domain.com so that updated the emails. I have seen it happen when there is a sql search with the domain expression.

1 Spice up

Fixed it via search and replace in all the tables individually with a top level search to identify which tables had the change in them
really only about 12-15 tables.
Had I been better at regex and mysql queries probably could have been completed in 15m, but resolved either way!

No one was accessing the DB - only 1 other could but doesn’t know how.
There are plugins that could have done this though just not sure which one it was.

broken Link Checker
Yoast
Wordpress Migrator
Wordfence
and a host of others

it was noticed a few days after all plugins were updated and site engine updated to 6.2 via the Updates menu…
thinking there was a bug in some of the re-write rules in one of those and it hit the DB…

not major fixed but still odd