How to Find and Remove Rogue WordPress Admin Accounts

Last updated: August 23, 2026

To find and remove a rogue WordPress admin account, list every user with the administrator role, compare registration dates against your own records, and query the database directly — malware often hides accounts from the Users screen. Delete the account, then rotate salts and passwords, because deleting a user does not end their session.

What is a rogue admin account?

A rogue admin account is an administrator user created by an attacker rather than by you. It is the most common persistence mechanism in WordPress compromises, because it survives plugin updates, theme changes and malware cleanups — an attacker who keeps a valid admin login does not need their original exploit any more.

They usually look mundane on purpose. Common patterns are a plausible name such as wpsupport, admin2 or backupuser, an email address on a domain you do not recognise, and a registration timestamp that clusters around the date a known vulnerability was disclosed.

How do rogue admin accounts get created?

Almost always through a vulnerable plugin rather than a guessed password. Three separate WordPress campaigns in 2026 alone ended with attacker-created administrators, and in each case the site owner’s password was never involved. That is why password strength alone is not a defence against this.

Route	2026 example	What the attacker needed
Poisoned vendor API feed	BdThemes supply-chain attack (August 2026)	An admin to simply load wp-admin
Authentication bypass	User Profile Builder CVE-2026-15826	A registration form and one failed signup
Arbitrary file upload to webshell	Forminator CVE-2026-15748	A public form with upload and select fields
Stolen or reused credentials	Ongoing	A leaked password with no 2FA

We covered two of these in detail: the BdThemes supply-chain hack and the User Profile Builder admin takeover. Both produce exactly the symptom this guide addresses.

How do I find hidden admin accounts in WordPress?

Check three layers, in this order: the Users screen, the WP-CLI user list, and the wp_usermeta table directly. Each layer catches what the previous one can miss, because malware can filter accounts out of the dashboard while leaving them fully functional in the database.

Layer 1: the dashboard

Go to Users → All Users and click the Administrator filter. Note the count. On most sites it should be one or two. Sort by the date column and look for anything registered around a disclosure date you recognise.

Layer 2: WP-CLI

# Every administrator with the date the account was created
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# Anyone registered since a date you care about
wp user list --field=ID --registered_date_query='[{"after":"2026-06-01"}]'

Layer 3: the database (the one that matters)

This is the step most guides skip. Malware commonly hooks the pre_user_query filter to strip its own account out of the Users screen, so the dashboard shows two admins while the database holds three. Querying wp_usermeta for the capabilities key bypasses every PHP-level filter:

SELECT u.ID, u.user_login, u.user_email, u.user_registered
FROM wp_users u
JOIN wp_usermeta m ON u.ID = m.user_id
WHERE m.meta_key = 'wp_capabilities'
  AND m.meta_value LIKE '%administrator%'
ORDER BY u.user_registered DESC;

Run it with wp db query or in phpMyAdmin. Adjust the wp_ prefix if yours differs. If this returns more administrators than the dashboard did, treat the site as actively compromised — something is running code specifically to hide a user from you.

One more check worth running: administrators whose account has no posts, no login history and a recent registration date are far more suspicious than an old dormant editor account.

How do I remove a rogue admin account safely?

Record the evidence first, then delete the account, then invalidate every session on the site. Deleting the user alone is the single most common mistake — an attacker’s login cookie stays valid until the authentication salts change, so they can simply create another admin afterwards.

1. Record it. Save the username, email, registration date and IP from your access logs before deleting anything. You may need this for a host or client report.
2. Take a backup. Snapshot files and database now, so a mistake in the next steps is recoverable.
3. Delete the account and attribute its content to a real user: wp user delete 42 --reassign=1.
4. Reset every remaining admin password and revoke all application passwords under each user’s profile.
5. Rotate the salts in wp-config.php using fresh values from the WordPress secret-key API. This force-logs-out every session, including the attacker’s.
6. Find how they got in. Audit plugins for known vulnerabilities and search for webshells. Removing the account without closing the hole means it returns within days.
7. Re-check the database query from the previous section 24 hours later to confirm nothing has reappeared.

Step 6 is where most cleanups fail. If you find a webshell alongside the rogue account, the account was a symptom rather than the entry point — our WordPress webshell cleanup walkthrough covers that full procedure.

How do I stop rogue admins coming back?

Reduce the number of administrators, patch quickly, and add an alert that fires the moment a new administrator appears. Detection speed matters more than prevention here: every route in the table above bypasses passwords entirely, so the realistic goal is finding the account in hours rather than months.

• Cut admin count. Most people who have the administrator role need editor instead.
• Alert on role changes. A security plugin that emails you when an administrator is created turns a silent compromise into a notification.
• Patch on a schedule you actually keep. Exploitation of newly disclosed plugin flaws now begins within hours of disclosure.
• Enable two-factor authentication on every admin account. It does not stop plugin-level bypasses, but it closes the credential-reuse route entirely.
• Audit dormant plugins. Deactivated plugins still ship code to your server; delete what you do not use.

For the monitoring piece specifically, compare options in our guide to the best WordPress security plugins — the relevant feature to look for is user and role-change auditing, not malware scanning.

Frequently asked questions

Can a rogue admin hide from the WordPress Users page?

Yes. Malware can hook the pre_user_query filter to remove its own account from the Users screen while leaving it fully usable. This is why you should confirm the administrator count with a direct wp_usermeta query rather than trusting the dashboard.

Does deleting the account log the attacker out?

Not necessarily. Authentication cookies are signed with the salts in wp-config.php, so sessions can remain valid after the user record is gone. Rotating those salts is what actually terminates every active session on the site.

Should I delete or just demote the account?

Delete it. Demoting leaves a valid login the attacker still controls, and a subscriber account is enough to exploit several privilege-escalation flaws. Reassign any content it owns to a legitimate user during deletion.

How do I tell a rogue admin from a legitimate one I forgot about?

Check the email domain, the registration date and whether the account has ever published anything. A legitimate forgotten account usually has history; an attacker’s account is typically recent, has no content, and uses an email address on a domain unconnected to your organisation.

Will a firewall prevent rogue admin creation?

Sometimes. A web application firewall can block the exploit request that leads to account creation, and many flag the creation event itself. It cannot help when the malicious action is performed by your own authenticated browser session, as in the BdThemes campaign.