You're misinterpreting the
is_admin() function. It's not a tag to check whether or not the user is an admin, it's a template tag to check if you're on an admin page.
From the Codex:
This Conditional Tag checks if the Dashboard or the administration panel is being displayed. This is a boolean function, meaning it returns either TRUE or FALSE.
You're facing a couple of issued here though.
- If you attempt to go to
/wp-admin while you're not logged in, WordPress will automatically redirect the page. A request to
/wp-admin is really a request to
/wp-admin/index.php, a page non-logged-in users don't have permission to see in the first place. So you'll be redirected to
/wp-admin/wp-login.php which doesn't necessarily load your plugin code.
- I say "doesn't necessarily load your plugin code" because I'm not sure. From the looks of things you're
return exists in the global scope. Really, this code should be wrapped in a function and hooked to a WordPress action.
Now, if you go to the
/wp-admin page while you're logged in,
is_admin() will evaluate to
true you should be able to see the content of your
echo statement just fine, assuming a couple of things:
- No errors in your code (as both @amit and @Fraggy have pointed out, you have a typo - an unescaped
- That you're hooking things in at the right place. You shouldn't just
return in the global scope because, really, there's no way to control where that
return will be happening. You should place this code in a function.
If you ever do find a security hole or security-related bug in WordPress, you should report it to firstname.lastname@example.org rather than posting in a public forum like this. This kind of responsible disclosure gives the team the chance to address and patch the issue before malicious hackers can read about it and exploit it.