Unknown Admin User in WordPress: What to Do

An administrator account you didn't create is one of the clearest signs of a compromise. It is also usually a symptom: the attacker needed access to create it, and may have left more than one way back in. Handle it in the right order.

1. Check whether it's actually unknown

Ask colleagues, agencies and freelancers whether they created it. Look at the registration date and email address. A legitimate account usually has a name and address someone recognises; an attacker's often has a random string, a throwaway email domain, or a name that imitates a plugin or "wordpress".

2. Don't just delete it yet

Take a copy of the files and database first. The account's details, creation time and the content it touched help establish when and how the site was entered. Note them: username, email, role, registration date, and any posts or pages assigned to it.

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp user get <ID> --fields=ID,user_login,user_email,roles,user_registered

Remember that some malware hides users from the dashboard list, so a clean-looking Users screen isn't proof. The database table is the authority.

3. Contain access

• Change the passwords of all legitimate administrators, from a clean computer.
• Replace the security keys and salts in wp-config.php so existing sessions end. See Hacked wp-config.php: What Site Owners Should Check.
• Revoke application passwords you don't recognise (Users, then the user's profile).

4. Remove the account

When deleting, WordPress asks what to do with the user's content. Reassign it to a legitimate user, or review it first, since attackers sometimes publish spam under their own account.

5. Find out how it got created

An account doesn't create itself. Likely routes: a vulnerable plugin that allows privilege escalation, a stolen administrator password, or malicious code already running on the site. Check the access logs near the registration time if your host provides them, and look at plugins updated or flagged around that date.

6. Look for what else was left

Check for other new or changed users, recently modified PHP files, unknown plugins and scheduled tasks. The WordPress Malware Cleanup Checklist covers each of these. If you only remove the user and leave the code that created it, the account may reappear.

When to bring someone in

If the account reappears, or you can't tell how it was created, you're likely dealing with persistence. See backdoor removal and malware removal. For the whole picture, the The Complete WordPress Hacked Site Recovery Guide covers the full lifecycle.