WP Compatibility Patch Plugin Creating and Hiding an Administrator

Summary

This WordPress malware research entry documents fake plugin hidden administrator evidence observed during one anonymized client investigation. The narrow topic is WP Compatibility Patch Plugin Creating and Hiding an Administrator: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The artifact is a fake compatibility plugin implementing persistent hidden administrator access. It overlaps a broad existing article, so this research entry is limited to exact plugin identifiers and code behavior.

Investigation context

Anonymized investigation with a retained WP Compatibility Patch sample and no publishable screenshot. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

The public entry does not use a screenshot because the retained images either exposed sensitive values, showed a complete encoded payload, or did not add reliable evidence beyond the supplied code.

Confirmed findings

• The plugin header identifies WP Compatibility Patch.
• The bootstrap function uses wp_insert_user or updates an existing named account.
• The role is administrator and the ID is stored under _pre_user_id.
• pre_user_query excludes that ID from administrator listings.

Technical analysis

How the plugin ties account creation to concealment

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

/** Plugin Name: WP Compatibility Patch */
$params = ['user_login' => 'adminbackup', 'role' => 'administrator'];
// credential and email removed
$id = wp_insert_user($params);
update_option('_pre_user_id', $id);
// query exclusion and plugin-hiding details shortened

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The artifact is a fake compatibility plugin implementing persistent hidden administrator access. It overlaps a broad existing article, so this research entry is limited to exact plugin identifiers and code behavior.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

• WP Compatibility Patch
• wpc_patch_bootstrap
• adminbackup
• _pre_user_id
• Plugin identity plus create-and-hide flow

Contextual indicators

• wp_insert_user()
• pre_user_query
• administrator role
• Compatibility-themed plugin name

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

• The hard-coded password and email are not published.
• The evidence does not establish how the plugin was installed.
• No vulnerable component, affected version, prevalence, or successful attacker login was confirmed.

Artifact-specific remediation

• Preserve the plugin directory and account records.
• Remove the fake plugin and inspect users directly in the database or CLI.
• Remove unauthorized accounts and the malicious option after recording their relationship.
• Rotate credentials and invalidate sessions.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

• Confirm the directory, account, and _pre_user_id do not return.
• Compare direct database and wp-admin user inventories.
• Monitor plugin creation and user-role changes.

Related malware research

Browse the WordPress malware research hub.

• Hidden Administrator Query Hooks Found in functions.php
• wp-user-query.php MU-Plugin Concealing a Stored User ID
• system-control Plugin Restored from wp-content/.sc-backup

Related guides and case studies

• WP compatibility backdoor guide
• How to find hidden WordPress administrators

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.