The Administrator You Can’t See: A WordPress Campaign That Hides Its Own Admin Account

Since October 4, Patchstack has tracked a campaign in which the same script arrives through vulnerabilities in two different plugins. Afterwards the site has an administrator who appears neither in the Users list nor in the counters above it.

How the script gets onto a site

The first vulnerability is in WPC Product Bundles for WooCommerce (about 30,000 installs), the second in Ninja Forms (more than 500,000). Both let an unauthenticated visitor store a malicious script on the site, in WooCommerce order metadata in the first case and in the text of a form submission in the second. The attacker doesn’t need anyone to click a link, because the script sits in a place the administrator visits anyway and runs when they open the order or the submission.

Instead of stealing cookies, the script works inside the session that is already open, loading wp-admin pages, taking the nonces from them and repeating actions as the administrator. HttpOnly doesn’t help here, because there is no cookie to read. This is how it installs a plugin called WP Smart Thumbnails, which does nothing when WordPress loads it, only runs when its file is requested directly over HTTP, and contains a file manager with no authentication.

The hidden administrator

A second script, installed along with the plugin, creates another administrator. The username comes from a list of ordinary words such as support, updater, maintenance or backup, and the email address is on @wordpress.org. A must-use plugin hides the account by removing it from the user list query and recalculating the role counters above the table. Must-use plugins can’t be deactivated from the admin, so removing WP Smart Thumbnails doesn’t touch them.

A second must-use plugin handles a link of the form /wp-login.php?_wplogin=token, which logs in as the oldest administrator on the site, usually the owner. The dates on the new files are forged, because the script takes the earliest modification date in the WordPress root and applies it to them, so a search for recently changed files finds nothing.

Four ways back in

After one successful run the attacker has four ways back, which are a regular administrator, the hidden administrator, the magic link and the file manager, and removing the vulnerable plugin closes none of the last three. The researchers point out that the attackers don’t care which plugin supplies the script, since they collect any stored XSS that puts JavaScript in front of an administrator and the chain after that is the same.

The vulnerabilities were disclosed on September 22 (Ninja Forms) and September 23 (WPC Product Bundles), and the first exploitation attempt was recorded on October 4. Fixes were already out by then, in WPC Product Bundles 8.6.7 and Ninja Forms 3.15.4.

What to take from it

Both plugins had fixes available before the first attack, which came 11 to 12 days after disclosure, so these two entry points only worked on sites that had not updated. Cleaning up afterwards takes far longer than the update would have, because removing the plugin leaves the other routes open. A site that ran an affected version while an administrator opened orders or form submissions should be treated as potentially compromised, and the original write-up lists what to look for.