wp2shell: more than a month later. Confirm 6.8.6, 6.9.5, 7.0.2. Patched is not clean.

Read the advisory

Firewall & login

Monitoring administrator accounts

Learn how Security Ninja’s Events Logger detects new WordPress admin accounts, logs suspicious database insertions, and sends instant alerts to protect your site.

Security Ninja’s Events Logger includes a robust monitoring system for new administrator accounts. This functionality ensures that you are immediately informed whenever a new admin user is created, whether through the standard WordPress interface or via direct database manipulation.

How It Works:

  • When a new admin user is created, the Events Logger checks the user’s role to confirm they have administrator privileges.
  • If the user is an administrator, a notification is sent to the site administrator, and the event is logged for future reference.
  • The system also checks for any direct database insertions, which can indicate potential security breaches.

Configuration:

To enable notifications for new admin user creation, navigate to the Security Ninja settings and ensure that the “Notify on new admin creation” option is enabled.

New user admin notifications settings

You will get warning emails like this:

New user admin notifications

Still stuck? Get help or contact us.

Larger screenshot