I logged into my wp-dashboard after a hack to find that there is a ‘ghost’ administrator of my site… the only problem is, I can’t just list the user table and delete it. I don’t know why, but here’s all I get when I click on the Admin tab, or the subscribers tab for that matter:

https://www.dropbox.com/s/uf0uxw40le82yaa/Screenshot%202016-12-14%2021.59.54.png?dl=0

It only lists me!

So, I know that the meta value for an admin is in the wp-usermeta and then wp-capabilities table… and is: meta_value=”a:1:{s:13:”administrator”;b:1;}

However, I”m really new to phpmyadmin, and I have no idea how to search for this. It doesn’t even look like I have this table either:

https://www.dropbox.com/s/cpkbtpihlymds9b/Screenshot%202016-12-14%2022.03.38.png?dl=0

No idea where to go from here 🙁

Your help would be much appreciated. Thanks for your time!

4 Answers
4

We can generate the SQL with:

$query = new WP_User_Query( 
    [ 
        'role'          => 'Administrator',
        'count_total'   => false,
    ]
);

echo $query->request;

that outputs:

SELECT wp_users.* 
FROM wp_users 
INNER JOIN wp_usermeta ON ( wp_users.ID = wp_usermeta.user_id ) 
WHERE 1=1 
    AND ( ( ( wp_usermeta.meta_key = 'wp_capabilities' 
        AND wp_usermeta.meta_value LIKE '%\"Administrator\"%' ) ) ) 
ORDER BY user_login ASC

You might have a different table prefix, than showed here.

Note that deleting the hidden administrator user, will most likely not fix the problem, as there might still be other backdoor(s). Recovering hacked sites is in general off topic here, but you could try to contact your hosting provider or security experts, regarding available backups, security reviews, etc.

Leave a Reply

Your email address will not be published. Required fields are marked *