WordPress glossary
wp-adminerlzp Hidden Admin User
A persistence backdoor that re-creates a rogue WordPress administrator with a wp-adminerlzp-style username after every cleanup.
Last updated ยท Reviewed by Ali Yasin Jatoi
wp-adminerlzp is one signature in a family of hidden admin accounts injected by attackers after a WordPress compromise. The account is recreated by a malicious mu-plugin or trojanized core file on every page load, so deleting the user in /wp-admin/users.php alone does not fix it. Permanent removal requires finding and removing the persistence source (usually under wp-content/mu-plugins/, wp-config.php, or a trojanized wp-blog-header.php).
Where this applies on our service