An administrator account you did not create means somebody else has had full control of your WordPress site. Not a bug, not a glitch, not a leftover from your old developer. Deleting the account is the right instinct and the wrong first move, because whatever created it can almost certainly create another one.
These accounts are often given deliberately dull names. Something like wpadmin, support, backupuser, or a plausible first name, so that a quick glance down the user list does not snag on it. Some are registered to an email address at a domain you have never heard of. Some use a convincing variation on your own.
Do this before you delete anything
Open the account and write down three things: the username, the email address on it, and the registration date. That date is the single most useful piece of information you have, because it tells you roughly when they got in, and that gives you a window to search your logs and file modification dates against.
Take a screenshot while you are there. If this turns into an insurance question, a client question or an ICO question later, you will be glad of it.
Then assume they saw everything
An administrator in WordPress can read every order, every customer address, every form submission, every uploaded file. If you run a shop or collect enquiries, work on the basis that the contents were visible, and take advice on whether that is reportable. In the UK, a personal data breach may need reporting to the ICO within 72 hours of becoming aware of it. I am a developer rather than a lawyer, so if real customer data is involved, get proper advice rather than mine.
Locking them out properly
Deleting the user is necessary but nowhere near sufficient. Work through all of this:
- Change every administrator password, including your own, and do not reuse anything
- Rotate the security keys and salts in
wp-config.php. This invalidates every active session at once, so anybody logged in as that user is thrown out immediately - Change the hosting, FTP and database passwords too. If they had file access, WordPress passwords alone will not shut the door
- Check the remaining users. Look for existing accounts whose role has been quietly promoted to administrator, which is subtler and more common than it sounds
- Check for a second hidden account. Some malware hides users from the dashboard list, so the count shown on the Users screen is worth comparing against the database
Then find the way in
An account appearing means something granted it. Usually one of three things: a vulnerable plugin or theme that allowed privilege escalation, a password that was reused on a site that got breached, or an existing backdoor from an earlier compromise you did not know about.
Until you know which, you have not finished. Look at what was out of date, look at the mu-plugins folder, look for PHP files anywhere in wp-content/uploads, and look at scheduled tasks for anything recreating users on a timer.
If you find nothing at all and the account reappears, stop guessing and get somebody to look properly. A backdoor you cannot find is not a backdoor that is not there.
Common questions
Could it just be my old developer or a plugin?
It is worth ruling out. Some plugins and managed hosts do create support accounts, and a previous developer may have left one behind. Check the email address against anybody you have actually worked with. If it does not match a real person you can name, treat it as hostile.
The site looks fine. Is it definitely serious?
Yes. Plenty of compromises are quiet on purpose, because a site that still works keeps earning for the attacker. Sending spam, hosting phishing pages and injecting links into your content are all things that happen invisibly while the site looks completely normal to you. Redirect malware is deliberately built to hide from the site owner in exactly this way.
I deleted the user and it came back. What now?
Then something on the site is recreating it, and the site is still compromised. Take it offline if you can and get it cleaned properly, because at that point you are not dealing with an account, you are dealing with persistent access.
Should I just rebuild the site?
Rarely necessary. A clean is usually faster and cheaper, and a rebuild on the same hosting with the same passwords will not help if the entry point was either of those.
If you would rather hand it over
Hacked site rescue is a fixed £200 and covers the lot: finding the infection, removing it, closing the route in, and hardening the site afterwards. If I cannot solve it, you do not pay.
Not sure whether what you have found is serious? Send me the username, the email address and the date, and I will tell you what it looks like from here.