I swear on my life, and I can confirm, that somehow a player is force-opping on my server. A player has reptitively gained OP on my server. My server's insanely popular and insanely secure. However, yesterday a player started posting that it had been hacked. I checked it out to find the player had somehow added himself to the OP list and griefed the spawn. He did not access/change my backend to the server at all, which is protected by 2 step google verification and 128 character passwords. He is somehow forcing op and unbanning himself. Don't believe me? NCP and Worldguard both block OP from my in-game. Somehow, the player is bypassing this and obtaining OP. No one else on my server can give OP but me. He has hacked and ruined my spawn 2x, and unbanned himself from a global database that I have setup with banmanagement. IT IS NOT ONLY ME. http://mclava.com, a major minecraft site, has been hacked too. Here is the information I have compiled about the hacker: To admins: I really need help. This is insanely frustrating and scary. What he is doing is not possible. Trust me when I say I have ran this server with 6 months without issue. I am scared and need advice. It can't be my host, either. It happened to mclava.com, and they use a different host than me. Plugin exploit?