Unknown Admin Accounts and File Manager Plugins: Hidden WordPress Risks to Check After PHP2Shell

What Attackers Did After the wp2shell Attacks

This chain is not theoretical. After the July 2026 "wp2shell" attacks on WordPress core, Wiz reported attackers uploading plugins containing webshells through the normal plugin installer, and InMotion Hosting's recovery write-up describes attackers creating new administrator accounts. A webshell is a small hidden script that lets an attacker run commands on your server from a browser.

InMotion Hosting also describes how attackers kept their foothold. They added a must-use plugin (mu-plugin: a plugin WordPress loads automatically and that can't be switched off from the Plugins screen) that restored deleted files. They also hid PHP files in the uploads folder disguised as core class files, and stored encoded payloads in the wp_options database table.

Don't confuse the two: wp2shell was a pair of WordPress core flaws (CVE-2026-63030 and CVE-2026-60137), while PHP2Shell is a pair of flaws in PHP itself. wp2shell shows what attackers do once they reach admin level, but it doesn't explain anything in our review.

Check the Users Screen

Go to Users → All Users and click the Administrator filter. The number in parentheses is your admin count, and you should be able to name the person behind each one.

Then check each row for these warning signs.

• An administrator nobody on your team recognizes.
• A generic or random-looking username, such as a word plus a string of letters and numbers.
• An email address on a domain unrelated to your business, or a disposable inbox.
• Admin rights with no posts or other legitimate activity.
• A registration date clustered around a known incident (the Users screen doesn't show it, so use the next check).

Double-Check With WP-CLI or the Database

Don't rely on the Users screen alone. Some malware hides rogue administrator accounts from it, so your dashboard can look normal while an extra admin still exists.

For developers: WP-CLI is the official command-line tool for managing WordPress from a server terminal. The command below lists every administrator with their ID, username, email and registration date, and it changes nothing.

Compare the output with the Users screen and question any registration date you can't explain. If an account appears here but not in the dashboard, or you want the final word, have your host or developer check the database directly.

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Rule Out Innocent Explanations

Innocent explanations are common: a former employee, a contractor, the agency that built the site, or a plugin or host support account that nobody removed. Treat the account as suspicious until someone verifies it, but don't call it malicious without evidence.

If a legitimate owner turns up, check that they still need full control: a former contractor's account should go, and a content writer can move to the Editor role.

• Ask your team, past agencies and your host whether the account is theirs.
• Match the registration date to onboarding records, contracts or support tickets.
• Contact the person through details you already have, not the account's email.
• Check its posts, plugin installs, settings changes and logins in your activity log.

What They Do, and Why Attackers Love Them

WordPress includes a Theme File Editor and a Plugin File Editor, under Appearance, Plugins or Tools depending on your theme. They let any administrator edit PHP files from the browser.

File manager plugins go further, adding full file-system access inside wp-admin: upload, edit or delete any file.

For an attacker, that is the ideal shortcut. With an admin login, or a flaw in the plugin itself, it becomes instant code execution on your server.

A Real Example: CVE-2020-25213 in the File Manager Plugin

The File Manager plugin (wp-file-manager) shows how bad a plugin flaw can get. Versions before 6.9 let attackers who had never logged in upload and run PHP files through a bundled elFinder connector file.

NVD rates it CVSS 9.8 out of 10 (critical). Rapid7 and NVD say it was exploited in the wild in August and September 2020, SonicWall reported active exploitation that year, and it is listed in CISA's Known Exploited Vulnerabilities catalog.

The lesson goes beyond one plugin: every tool that can write files to your server is another way in.

How to Remove the Risk

First, delete file manager plugins. For file changes, use SFTP (an encrypted file transfer connection) or your host's file manager, which sit behind your hosting login instead of your WordPress login.

Next, turn off the built-in editors with one line in wp-config.php, the main WordPress configuration file. DISALLOW_FILE_EDIT removes both editors, and normal updates keep working.

That doesn't close every door. Admins can still upload a plugin ZIP containing PHP unless DISALLOW_FILE_MODS is set, so who holds an admin account matters as much as which plugins you run.

DISALLOW_FILE_MODS blocks installing, updating and deleting plugins and themes from the dashboard, dashboard updates included. Only use it when updates happen another way: WP-CLI, your host or a deployment pipeline.

wp plugin list --fields=name,status,version,update

define( 'DISALLOW_FILE_EDIT', true );

wp config set DISALLOW_FILE_EDIT true --raw

define( 'DISALLOW_FILE_MODS', true );

The Recovery Basics, in Order

If you see one of these signs, slow down. Cleaning first is how evidence gets lost and attackers keep a way back in.

1. Preserve evidence: save the logs, plus a copy of the files and database, before you change anything.
2. Remove access: lock or delete the accounts and files involved, once they are documented.
3. Rotate all credentials: WordPress passwords, the database password, the hosting panel, SFTP or SSH logins, and API keys.
4. Shuffle the salts so every existing login session ends.
5. Restore from a known-clean backup if a compromise is confirmed, instead of trying to delete the bad parts by hand.
6. Monitor closely afterwards for returning accounts, new files and unusual logins.