An administrator was created outside WordPress

What Wordfence found

Wordfence looks for administrator accounts whose creation does not match what WordPress records. Typically the account was inserted straight into the database, bypassing the usual code path.

Why it matters

This is a persistence mechanism. An attacker who gains temporary access creates an administrator so they can return after the original hole is patched — which is why sites get reinfected weeks after a clean-up that looked complete.

How to fix it

1. 1Do not delete the account immediately. Note its username, email and registration date first.
2. 2Confirm with the site owner that nobody recognises it. Some management and hosting plugins legitimately create service accounts, and machine-generated names are not proof of malice on their own.
3. 3If unrecognised, delete it and audit all remaining administrators.
4. 4Rotate the passwords of every remaining administrator and regenerate salts to invalidate sessions.
5. 5Look for how the attacker got write access in the first place — this finding is a symptom.

Findings that often appear with this one

• A user has an easily guessed password Login
• A file appears to be malicious Malware

How WPSecureOps treats it

The connector reports this as suspiciousAdminUsers, suspiciousAdmins. WPSecureOps files it under Login and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.