One of our admin user’s profile information (name, email, billing & shipping address, etc.) somehow changed to that of a customer who had made a recent purchase. (We use CartThrob for eCommerce.) The user’s username and password remained the same.
The odd thing is that none of our customers have a unique member profile or account created. They all submit as guests through a default member profile. The only place this customer’s information appears is in the Store - Orders channel.
Has anyone experienced a similar glitch with ExpressionEngine or CartThrob?
I do not know when the change in profile information occurred; however, I do know that the customer whose information was pulled into the admin user’s profile placed their order around the same time an SSL Certificate was being renewed on the server and a Security Scan on the server was being conducted. So I’m not certain if all of this is related or mere coincidence.
Also, aside from an email address, the admin user’s profile was not filled out until this occurrence. (So, the email was replaced, and the name, billing/shipping information was populated.)
The Security Level on the user’s member group is set as “unlocked”. (They are not super admins.) I do know that there were no unwanted users snooping in the CMS, because I checked the IP addresses in the IP log and all were normal.
Any information on similar experiences would be greatly appreciated! Thanks!