What Is a Rogue Admin User?
Definition
A rogue admin user is an administrator account on a website or system that the owner did not create or no longer controls, usually added by an attacker. On WordPress, it gives the intruder full control of the site and a way back in after the visible malware is removed.
How It Works
WordPress assigns every user a role. The official documentation describes an Administrator as "somebody who has access to all the administration features within a single site," and on a single-site install that includes installing and editing plugins and themes and creating, editing, and deleting users. One administrator login is enough to rebuild an infection from scratch.
Attackers get a rogue admin account in a few common ways:
- A plugin vulnerability that lets anyone register with administrator rights (see the example below).
- A stolen or guessed admin password, then a second account created as a spare key.
- Code planted in a theme or plugin that recreates the account if it is deleted.
- Direct database edits, writing a user and role straight into the
wp_usersandwp_usermetatables.
Rogue accounts are built to blend in. Usernames often imitate legitimate ones, such as wpadmins or wpenginer (a near-copy of a hosting company's name), and they come with plausible-looking email addresses.
Real-World Example
On June 29, 2023, Automattic's Jetpack and WPScan security research team reported an active campaign against Ultimate Member, a plugin with more than 200,000 active installs. Monitoring on the WP.cloud and Pressable hosting platforms, which first logged the attack waves on June 4, had noticed "rogue new administrator accounts kept appearing" on compromised sites. The flaw, CVE-2023-3460, let unauthenticated visitors create accounts with administrator privileges by tricking the plugin into updating the wp_capabilities setting during registration. Attackers registered, logged in, and uploaded a malicious plugin. WPScan listed usernames such as apadmins and wpadmins, and code in functions.php that tried to create a persistent user. Early patches were bypassed until version 2.6.7.
Why It Matters for a Small Business
A rogue admin turns a one-time cleanup into a repeat incident. Sucuri's 2023 Hacked Website and Malware Threat Report, based on sites its team cleaned, found that 55.2% of websites with database malware had at least one malicious WordPress admin user, and it identified more than 11,000 unique malicious usernames. Sucuri notes its data reflects the environments it inspected, not the whole web. For a business site, that admin can add card skimmers, spam pages, or redirects, read customer form submissions, and lock the real owner out.
How to Spot It / How DTS Handles It
Check Users > Administrators regularly. Warning signs: an admin you do not recognize, a familiar name with an unfamiliar email, admin counts that differ between the dashboard and the database, and new admins reappearing after deletion.
DTS audits every account against the database, including the wp_capabilities entries in wp_usermeta, and looks for the code that recreates them in themes, plugins, and mu-plugins. With the owner's approval we remove both, rotate passwords and salts, review two-factor login for remaining admins, and patch the entry point. See our unknown WordPress admin user guide and our WordPress incident response package.
Related Terms
- Backdoor: a rogue admin is a backdoor that looks like a normal account.
- Plugin vulnerability: the most common way rogue admins get created.
- Privilege escalation: turning a low-level account into an administrator.
- Least privilege: give each user only the role they need.
- Eradication: rogue accounts must be removed before recovery.
- Brute force attack: password guessing that hands over the first admin login.
Sources
- WPScan (Automattic), Hacking Campaign Actively Exploiting Ultimate Member Plugin (vendor research): https://wpscan.com/blog/hacking-campaign-actively-exploiting-ultimate-member-plugin/
- NIST National Vulnerability Database, CVE-2023-3460: https://nvd.nist.gov/vuln/detail/CVE-2023-3460
- WordPress.org Documentation, Roles and Capabilities: https://wordpress.org/documentation/article/roles-and-capabilities/
- Sucuri, 2023 Hacked Website & Malware Threat Report (vendor research): https://sucuri.net/reports/2023-hacked-website-report/
Last updated October 14, 2026.