Hidden WordPress admin account created after plugin update

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•3

This rule detects the creation of a new administrator account in WordPress within one hour of a specific plugin update event (specifically for the 'admin-menu-editor-pro' plugin). This pattern is indicative of a post-exploitation activity where a compromised or vulnerable plugin is used to gain administrative access to the WordPress instance.