WP-CLI Users: who are your administrators?

Who are your administrators? Ask the database, not the dashboard.

wp user list –role=administrator –fields=ID,userlogin,userregistered Three admins registered within three seconds at 3 a.m. After a compromise, wp-admin is the last place to trust.

Recovery is one block:

1. Look first: wp user get owner
2. Regain control: wp user update owner –user_pass=…
3. Keep evidence: wp db export evidence-$(date +%F).sql
4. Kill persistence: wp user delete 87 88 89 –reassign=1
5. Verify: wp user list –role=administrator
6. Backdoors hide in options: wp option get preuser_id → wp option delete
7. Rotate the keys, everyone logs in again: wp config shuffle-salts

Next practice case on 4wp.dev: post-compromise recovery with WP-CLI only. Break nothing.

Go deeper

• Full guide: 4wp.dev/wp-cli