Hidden admin account in WordPress: how to find and remove it

A hidden WordPress admin is an administrator account that wp-admin does not list, so the Users screen cannot find it. To find one, read the administrators straight from the database and compare them with the dashboard, then check the mu-plugins folder. Any account in the database that wp-admin does not show needs removing, along with the files that hide it.

Who needs to look for a hidden admin?

Anyone who ran Ninja Forms 3.15.3 or older, or WPC Product Bundles for WooCommerce 8.6.6 or older, in early October 2026. Patchstack reports Ninja Forms on more than 500,000 active installations and WPC Product Bundles on more than 30,000.

Patchstack's write-up is the best-documented case we found at our check on 28 October 2026, so this page follows it. BleepingComputer independently reports the same two plugins and the same install counts. If you saw a plugin you did not install, or an order or form entry with odd script-like text in it, start here.

Why can't the dashboard show a hidden admin?

Patchstack describes a must-use plugin that changes the user query. The account then drops out of the Users list, the Administrator filter and the role counts above the list. The script arrives through stored data, such as a form submission or WooCommerce order data, and runs when an administrator opens it. Patchstack describes both flaws as unauthenticated stored XSS, meaning the person planting the script needs no login.

This is why a clean-looking Users page proves nothing. Per the WordPress developer docs, must-use plugins load automatically, cannot be disabled from wp-admin, and sit in a separate Must-Use section of the Plugins screen instead of the normal list. Deleting the visible fake plugin leaves them in place.

WP-CLI is not a safe way around this. Its docs say wp user list follows WP_User_Query and that mu-plugins are still loaded when you skip plugins. A filter loaded as a must-use plugin could therefore affect that output too. That is our reading of the two docs, not something Patchstack tested. Patchstack's own method is a direct database read.

How do I find the hidden admin?

Work from outside the WordPress application, ideally with your host's database tool or support team.

• List every user whose capabilities include administrator straight from the database tables, not through wp-admin.
• Compare that list with the Users screen. An account in the database and absent from wp-admin is the hidden one.
• Look at the names and emails. Patchstack reports @wordpress.org addresses and routine-sounding names such as support, updater and maintenance.
• Open wp-content/mu-plugins. Patchstack names class-wp-query- followed by eight hex characters, and class-wp-token-validate.php. Any file you cannot account for is a lead.
• Check the options table for fz_emer_done_v1 and fz_emer_login_tokens.
• Look for a plugin called "WP Smart Thumbnails" or any plugin you did not install.

Do not sort by modification date. Patchstack reports that the installer backdates the files it writes to the oldest timestamp in the WordPress root, and advises sorting by content instead. Each mu-plugin file also carries a per-site key, so file hashes differ between infected sites.

How do I remove it, and in what order?

Patchstack does not define "clean" as a single state. It says a site where the script ran should be treated as potentially compromised, and its closing guidance lists five steps in this order. Follow it.

1. Remove the unauthorized accounts and plugins.
2. Clear the dropped files from mu-plugins.
3. Delete the fz_emer_done_v1 and fz_emer_login_tokens options.
4. Rotate privileged credentials and the WordPress authentication salts.
5. Review the filesystem and database for further changes.

Patchstack adds that deleting the options alone is not enough, because the must-use files can issue a fresh token if they remain. It also says to treat the oldest administrator's password as compromised, since the secret login URL signs the holder in as that account.

WordPress.org's FAQ on a hacked site covers the wider process. The table puts the two side by side.

WordPress.org's wp-config.php page shows where the keys and salts live. Its password reset page covers resetting from outside wp-admin.

Update the plugin too. Ninja Forms 3.15.4 and WPC Product Bundles 8.6.7 are the versions Patchstack names. Both plugins have shipped further XSS fixes since (Ninja Forms 3.15.5 on 28 September and 3.15.6 on 15 October, WPC Product Bundles 8.7.3), so install the current release. BleepingComputer reports that an update blocks further exploitation but does not remove an infection already in place. Ninja Forms is not the only form plugin with recent flaws, and the form plugin risk tracker covers the rest.

What do I do if my host manages the site?

Send support this and keep the reply:

For [your domain], please list all users with the administrator capability straight from the database, and tell me about any that do not appear in wp-admin. Please also list every file in wp-content/mu-plugins with its size and any option named fz_emer_done_v1 or fz_emer_login_tokens. Then tell me what backups you keep and how far back they go.

What do I do if I manage the server myself?

• Take a copy of the site and database first. WordPress.org advises one more snapshot before cleaning, even if infected, and has a backup guide.
• Work through the five steps above.
• Reset every administrator password, not only the one you recognise.
• Change the passwords again once the site is clean, as WordPress.org advises.
• Consider new database credentials, which WordPress.org also suggests, and update wp-config.php.
• Use a database tool such as phpMyAdmin if you cannot log in. It bypasses the administration screens.
• After recovery, work through WordPress.org's hardening guide.

We found no primary source that says whether a backup of this campaign carries the hidden account, so this page makes no claim about restoring from backup. Ask your host which backup dates exist and check any restored copy with the database read above. How to pick a restore point that is actually clean has its own page.

Am I affected? A three-state self-test

Was anything exploited, and what does a scan see?

Patchstack reports active exploitation and calls the volume limited in its own telemetry. That is a vendor's view of its own data. We found no primary source naming a victim, and this page names none.

Red's free scan reads the stack your site serves and matches each version to known vulnerabilities. It is a lookup: it can say a version is affected, not whether your setup is exposed. It cannot read your user table. A hidden admin is for the owner's evidence, not a scan result.

What else does the campaign leave behind?

Patchstack lists four ways back in. A visible administrator, the hidden administrator, a login URL that signs in as the oldest administrator, and a file manager that needs no login. The hidden account is one of four, so finding it does not finish the job. If the same files or accounts keep returning, why WordPress malware comes back explains the usual causes, and hardening after a PHP incident is the follow-up. More in the other WordPress guides.

Related reading: the October 2026 security checklist for this week and who is responsible for patching my website. The hub is the October 2026 security tracker.