3

I logged into my wp-dashboard after a hack to find that there is a 'ghost' administrator of my site... the only problem is, I can't just list the user table and delete it. I don't know why, but here's all I get when I click on the Admin tab, or the subscribers tab for that matter:

https://www.dropbox.com/s/uf0uxw40le82yaa/Screenshot%202016-12-14%2021.59.54.png?dl=0

It only lists me!

So, I know that the meta value for an admin is in the wp-usermeta and then wp-capabilities table... and is: meta_value='a:1:{s:13:"administrator";b:1;}

However, I'm really new to phpmyadmin, and I have no idea how to search for this. It doesn't even look like I have this table either:

https://www.dropbox.com/s/cpkbtpihlymds9b/Screenshot%202016-12-14%2022.03.38.png?dl=0

No idea where to go from here :-(

Your help would be much appreciated. Thanks for your time!

6

We can generate the SQL with:

$query = new WP_User_Query( 
    [ 
        'role'          => 'Administrator',
        'count_total'   => false,
    ]
);

echo $query->request;

that outputs:

SELECT wp_users.* 
FROM wp_users 
INNER JOIN wp_usermeta ON ( wp_users.ID = wp_usermeta.user_id ) 
WHERE 1=1 
    AND ( ( ( wp_usermeta.meta_key = 'wp_capabilities' 
        AND wp_usermeta.meta_value LIKE '%\"Administrator\"%' ) ) ) 
ORDER BY user_login ASC

You might have a different table prefix, than showed here.

Note that deleting the hidden administrator user, will most likely not fix the problem, as there might still be other backdoor(s). Recovering hacked sites is in general off topic here, but you could try to contact your hosting provider or security experts, regarding available backups, security reviews, etc.

2
SELECT u.ID, u.user_login, u.user_nicename, u.user_email
FROM wp_users u
INNER JOIN wp_usermeta m ON m.user_id = u.ID
WHERE m.meta_key = 'wp_capabilities'
AND m.meta_value LIKE '%administrator%'
ORDER BY u.user_registered

Look at the database prefixes.

1

Navigate to the wp_users table on your php myadmin and see if you are the only one on the table. If so consider changing your wordpress password and database username or password. They could be using your account if theres no other users in the table

Edit:

Only just noticed you have many subscribers to the website. To check who is admin on wordpress under the wordpress meta tag look for anyone else with this input. Then delete the user. This will be the other admin

a:1:{s:13:"administrator";b:1;}

0
FROM wp_users INNER JOIN wp_usermeta 
ON wp_users.ID = wp_usermeta.user_id 
WHERE wp_usermeta.meta_key = 'wp_capabilities' 
AND wp_usermeta.meta_value LIKE '%Administrator%' 
ORDER BY wp_users.user_nicename```

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.