An unfamiliar application password deserves review, but is not proof of a hack on its own. These are separate API credentials attached to a WordPress user. Verify the integration owner and revoke unauthorized credentials as part of a wider account investigation.
Understand what the credential controls
WordPress application passwords authenticate applications and scripts, rather than interactive wp-admin logins. They are individually revocable and linked to a user account. The profile can expose names and usage metadata. A vague label or unfamiliar IP is a starting point for investigation, not conclusive attribution to an attacker.
Inventory legitimate integrations first
Ask who connects publishing tools, mobile clients, maintenance systems and external applications to the site. Compare that inventory with the affected user profile. Record the credential label and available timestamps before revoking anything suspicious. Do not copy the secret into an incident document; use identifiers and sanitized metadata.
Contain unauthorized access
If the account owner cannot account for a credential and the surrounding evidence suggests compromise, revoke it and review the parent user account. Coordinate the action with business-critical integrations so legitimate publishing or order workflows are not unexpectedly interrupted. Treat the website, hosting panel and linked service accounts as distinct access paths.
Investigate the account, not only the password
Build a timeline around new content, user changes and available access logs. Review unexpected administrators, vulnerable components and other means of persistence. Do not assume changing an interactive login password proves every separate integration credential has been invalidated. Explicitly inventory the credentials you intend to remove and verify their state.
Verify recovery and document ownership
Confirm legitimate integrations still work with their approved credentials. For revoked access, have an authorized administrator verify it can no longer authenticate without disclosing the credential. Record an owner and purpose for each remaining integration, use the minimum suitable account privileges and watch for new unexplained credentials or content changes.
Questions about this problem
Can an application password log into wp-admin?
WordPress application passwords are intended for API authentication, not the standard interactive login form.
Does an unfamiliar IP prove abuse?
No. A legitimate service may use shared or changing infrastructure. Compare it with the integration owner, time and actual activity.
Primary references
General diagnostic guidance, not a diagnosis of an individual site. Use a recoverable copy for changes that may affect production.