Website Security
The Hidden Admin Account: How We Found (and Fixed) a WordPress Hack Designed to Go Unnoticed
Annexal Security Team · Jul 3, 2026 · 6 min read
A client came to us with a small but nagging problem: their WordPress site kept sending login notifications they didn’t recognize. No obvious damage. No defaced homepage. No ransom note. Just a quiet, recurring “someone signed in” email that didn’t match anyone on the team.
That kind of low-key warning is easy to dismiss. It’s also exactly how the most dangerous hacks tend to announce themselves — not with a bang, but with a small detail that doesn’t add up.
What we found
When we dug in, we discovered a backdoor disguised as a legitimate security plugin — the kind of file a busy site owner would scroll right past, since it looked like it belonged there. Hidden inside it was a secret administrator account, one with full control over the site.
Why this one was different
The malware had quietly altered the code WordPress itself uses to display the list of user accounts. When the client checked the Users page to see who had access, the hidden account simply didn’t show up — even the account count looked normal. It was built specifically to survive a routine check.
We traced the root cause back to a “cracked” copy of a premium page-builder plugin — one of those free downloads of paid software you sometimes find outside the official marketplace. Those copies are frequently modified by attackers before being redistributed, with malicious code baked in from the start.
What we did about it
Once we understood what we were dealing with, we followed a structured process rather than jumping straight to deleting things:
Backed everything up first, so there was a safe copy of the site before we touched anything.
Scanned the site’s files to map out exactly what had been changed or added.
Studied the malicious code before removing it, to understand its full scope — a hacker rarely leaves just one door open.
Removed the backdoor and the fake admin account it had created.
Changed every password in the system — WordPress logins, hosting and file-transfer access, and the database — in case any of them had been exposed.
Reset WordPress’s internal security keys, which immediately logs out anyone with an active session, including an attacker who might still be connected.
Turned on two-factor authentication for all admin accounts, so a stolen password alone isn’t enough to get back in.
Closed an unrelated exposure we noticed along the way: a debug log file that was publicly viewable and could have leaked sensitive information.
Updated everything — WordPress itself, plugins, and themes — to current versions, closing off known vulnerabilities.
Handed the client a clear report spelling out what we’d fixed versus what still needed their attention (like renewing a legitimate license for that page-builder plugin, or rotating payment gateway keys tied to their own accounts).
The takeaway
The scariest part of this incident wasn’t the hack itself — it’s that a normal person doing a normal check would have found nothing wrong. That’s not a knock on the client; it’s the point of this kind of malware. It’s built to blend in.
A few practical lessons worth taking from this, whether you run a WordPress site or any other website:
Don’t run the “free” version of a paid plugin
Do assume a cracked copy has been tampered with — a license costs far less than a cleanup
Don’t stop at “the scanner came back clean”
Do remember a surface-level check can miss malware built specifically to hide from it
Don’t dismiss small, weird signals — an odd login alert, a slightly-off user count
Do investigate — that’s often the only visible thread connecting to a much bigger problem
Don’t stop at deleting the bad file
Do rotate every credential, reset security keys, and enable two-factor authentication — that’s what actually closes the door behind you
If something about your site feels slightly off — even something small — it’s worth a second look. The incidents that do the most damage are usually the ones that looked the least alarming at first.
Think your site might be compromised?
We find what surface-level scans miss — and fix it properly.
Full incident response for WordPress sites: detect, investigate, remove, rotate every credential, and harden against recurrence.
