Finding and Removing a Hidden WordPress Admin User

A coordinated attack campaign is actively targeting unpatched WordPress plugins to silently take over sites. By weaponizing stored Cross-Site Scripting (XSS) vulnerabilities, attackers run malicious JavaScript directly inside the browser of an authenticated administrator. This script quietly installs unauthorized plugins, adds backdoors, and registers a hidden wordpress admin user that never shows up on your standard Users screen. If your site accepts form submissions or complex product bundles, you need to understand how this infection works and how to detect it.

How the WordPress Stored XSS Campaign Works

Security researchers at Patchstack documented an active WordPress stored XSS campaign in early October 2026. Telemetry identified identical payloads delivered through vulnerabilities across completely different plugins, notably targeting CVE-2026-93836 in WPC Product Bundles for WooCommerce on October 4, followed by CVE-2026-94504 in Ninja Forms on October 5.

Stored XSS happens when unvalidated input gets saved to the database and rendered later without proper HTML escaping. In the WooCommerce bundle flaw, attacker markup slipped through product quantity parameters into order metadata. In Ninja Forms versions through 3.15.3, unencoded textarea fields ran scripts in the legacy submission view.

When an authenticated administrator views the compromised order or form submission, the stored script triggers automatically. The browser loads an external script hosted on attacker infrastructure (such as imgcdn1.com), which executes high-privilege actions instantly.

Why Nonces Cannot Stop Authenticated XSS

WordPress developers use security nonces to prevent Cross-Site Request Forgery (CSRF). As outlined in the WordPress developer documentation on nonces, nonces verify that an incoming request originated from the current site and an intended user action.

However, nonces do not protect against Cross-Site Scripting. Because the injected JavaScript executes directly within your active administrative session, the script has full access to the DOM.

The malicious script simply reads valid nonces embedded in the admin markup or retrieves them through background AJAX calls. Once it grabs a valid token, it submits authenticated requests to create users or install plugins without triggering security warnings.

How Attackers Hide Rogue Admin Accounts

In standard infections, an unauthorized administrator appears in Users > All Users. This campaign uses post-exploitation code designed to conceal the intrusion so the site owner continues normal operations unaware.

The attack script drops an unauthenticated file manager and injects filters into WordPress hooks such as pre_user_query or views_users. By altering the database query that builds the administrative user list, the code strips the attacker’s account from the table interface.

In addition to hiding the user, the implant can install an alternative login URL that grants administrative access under the identity of the original site owner. To evade file scanners, the malware even backdates modified plugin files so their timestamps match older core files.

How to Find Rogue Admin Users in WordPress

Because the admin interface may be tampered with, you cannot rely on wp-admin to verify user integrity. You must audit the database directly to find rogue admin users in WordPress.

Run a Database Audit in phpMyAdmin

Open your hosting database management tool and run a SQL query against the wp_users and wp_usermeta tables (adjusting for your database prefix):

SELECT u.ID, u.user_login, u.user_email, u.user_registered, m.meta_value 
FROM wp_users u 
JOIN wp_usermeta m ON u.ID = m.user_id 
WHERE m.meta_key = 'wp_capabilities' 
AND m.meta_value LIKE '%administrator%';

Review every record returned. If you see an unrecognized username, a suspicious email domain, or an account created around the time of unexpected plugin edits, you have found a rogue administrator.

Check Users via WP-CLI

If you have SSH access, bypass the web server layer entirely using WP-CLI. Run the following command from the root of your WordPress installation:

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Compare the command output with your verified team members. Any account not listed in your internal directory must be investigated immediately.

Inspecting the Filesystem for Backdoors

Finding the account is only half the battle. If you delete a wordpress backdoor admin account without removing the persistence implant, the attacker will regain access immediately.

Check wp-content/plugins/ and wp-content/mu-plugins/ for unfamiliar directories. Attackers frequently install standalone plugins containing heavily obfuscated code or web-based file managers hidden behind multiple encoding layers.

Inspect your active theme’s functions.php file and your wp-config.php file for suspicious add_filter calls that target user queries. Even stores following standard WooCommerce security practices can miss hidden files if file integrity monitoring is not active.

Steps for WordPress XSS Malware Removal

Remediating an active injection requires systematic cleanup. Avoid editing live files haphazardly without a containment strategy.

1. Take an offline snapshot: Before modifying files, secure an untouched backup of your database and filesystem according to the 3-2-1 backup rule for forensic review.
2. Delete malicious accounts: Use WP-CLI or direct SQL queries to drop the rogue administrator account from wp_users and wp_usermeta.
3. Remove dropper files: Erase unauthorized plugins, unfamiliar .php files in upload directories, and abnormal mu-plugins.
4. Patch vulnerable software: Update Ninja Forms to version 3.15.4 or higher, and update WPC Product Bundles for WooCommerce past version 8.6.6 to close the initial injection vectors.
5. Rotate credentials and salts: Invalidate all user sessions by generating fresh security keys in wp-config.php, and force password resets for all legitimate administrators.

For more detailed remediation workflows, review our comprehensive guide on WordPress malware removal to ensure no persistent scripts remain.

FAQ

How do hackers hide admin accounts in WordPress?

Attackers inject code into WordPress filters like pre_get_users or views_users. When an administrator loads the Users screen, the custom code intercepts the database query and removes specific user IDs from the displayed results.

How can I tell if my WordPress site has a rogue administrator?

Do not check solely through wp-admin. Log in to phpMyAdmin or connect via WP-CLI to query the wp_users table directly, looking for unknown emails or recent registration dates with administrative capabilities.

What should I do if an XSS script created an unauthorized user?

Immediately place the site in maintenance mode. Delete the rogue user directly through the database, purge unauthorized plugins, update the vulnerable plugins responsible for the injection, and rotate all WordPress secret keys and database passwords.

What to Do Next to Protect Your Site

Audit your user database right away, update both Ninja Forms and WPC Product Bundles for WooCommerce immediately, and scan your mu-plugins directory for unverified scripts. If you suspect an intrusion and prefer an expert team to clear backdoors safely, our WordPress hacked-site recovery service can identify hidden users and secure your installation completely.