A WordPress user you did not create is a break-in, not a glitch.

What this usually is

Unknown users mean someone had (or still has) the ability to write to the database. Common doors: stolen admin password, XML-RPC brute force, a vulnerable plugin, a leftover “admin” account from the original build, or a file that creates the user on every load. Deleting the row in wp_users without finding that file is a loop.

What you are probably seeing

• Administrator or Editor you did not create
• Author accounts publishing casino or pharma posts
• A user that returns after you delete it
• Last login or “registered” date that does not match any staff hire
• An “admin” account that is not the one you use

What not to do

• Do not only delete the user. Check whether a file or cron is recreating it.
• Do not email that user “who are you?” from the site. You are talking to the attacker.
• Do not reset only your password and leave every other administrator alone. Reset the ones you know, remove the ones you do not, then rotate secrets we can reach.

What we actually do

We dump the user list and creation dates, find how the account got there, remove leftover admins, and close the door (Phase B: passwords, salts we can reach, file editor off, login protection). That sits inside the published WordPress IR packages. If the same password is also the Microsoft 365 global admin, say that on the call — that is a bigger incident.

Published rates live on the WordPress incident-response packages page: Phase A from $2,500, Phase B from $2,000, combined from $4,200. Remote nationwide. Onsite in the Tri-Cities and Western North Carolina if you want someone in the room. If the WordPress site is the front door to a larger business compromise, start at emergency incident response instead.