GoDaddy said an attacker used a compromised password to access systems hosting and managing WordPress servers around September 6, 2021; the company discovered the intrusion on November 17 and reported it to the SEC on November 22. The report said credentials and some customers’ SSL private keys were exposed. GoDaddy reset passwords and keys and was generating replacement certificates.
Sources
GoDaddy has reset WordPress passwords and private keys, so it's already taken the steps required to stock the attacker from exploiting anything with the passwords obtained. The company is in the process of generating new SSL certificates for customers.