How to Detect Hidden Admin Users

The Threat of Ghost Admins

After successfully breaching a WordPress site, attackers need a way to ensure they can return later. While they might upload a PHP backdoor, another common tactic is creating a "ghost" administrator account.

Why They Don't Show Up in the Dashboard

Attackers often inject these users directly into the wp_users and wp_usermeta tables using SQL injection or an existing backdoor. By cleverly manipulating the meta keys, or by modifying core WordPress files to filter out their specific username from the user list, they can make the account invisible from the standard /wp-admin/users.php screen.

How to Audit Your Users

The best way to verify your users is to check the database directly. Use a tool like phpMyAdmin or a secure SSH connection to run a `SELECT * FROM wp_users` query. If you see an unrecognized account with administrator capabilities in wp_usermeta, delete it immediately and audit your site for vulnerabilities.