Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Delete abandoned Buddypress accounts

  • Participant
    Level: Enlightened
    Posts: 30
    Michael on December 9, 2024 at 9:12 pm #53621

    Hi guys,

    Is there an easy way to block-delete old abandoned Buddypress accounts?

    By abandoned, I specifically mean accounts which were active in the past but the user has simply not visited the site in a long time and the “Last Active” info on their profile is showing as, for example, “Last Active: a year ago”.

    I understand Buddypress stores this “last_active” info as usermeta, so the information is available.

    Is there any code to do this, ie. to block-delete all accounts whose last_active usermeta is older than 365 days, for example?

    My site has 20,000 members, of which probably half are “abandoned” accounts. So need to be deleted.

    Any help is appreciated!

  • Keymaster
    (BuddyDev Team)
    Posts: 24697
    Brajesh Singh on December 12, 2024 at 9:09 pm #53633

    Hi Michael,
    Thank you for the question.

    We created one for users who did not activate their account.
    https://github.com/buddydev/delete-inactive-bp-users/blob/master/delete-inactive-bp-users.php

    You can do something similar by comparing their last activity time in the activity table instead of signup.

    Regards
    Brajesh

  • Participant
    Level: Enlightened
    Posts: 30
    Michael on December 14, 2024 at 1:30 am #53722

    Hi Brajesh
    Thankyou, unfortunately my knowledge of SQL queries is too limited to modify your plugin code safely.

    I tried to write a function to do the deletions by looping through the user IDs. Is this a reasonable way to approach it? It works on my test site but please could you review the code to confirm it’s safe to use.

    Code loops through user IDs, checks if user exists, checks the last_activity and if older than 365 days ago then the account gets deleted.

    
function delete_abandoned() {
	
	require_once( ABSPATH.'wp-admin/includes/user.php' );
	$nowTime = time();

	for ( $x = 1; $x <= 1000; $x++ ) {
		
		$user = get_user_by( 'ID', $x );
		
		if ( $user ) {
			$lastTime = strtotime( bp_get_user_last_activity($x) );
			$daysAgo = intval( ($nowTime - $lastTime) / (3600*24) );
			
			if ( $daysAgo > 365 ) {
				wp_delete_user($x);
			}
		}
	}
}

You must be logged in to reply to this topic.

This topic is: not resolved