wp-user-query.php MU-Plugin Concealing a Stored User ID

Summary

This WordPress malware research entry documents mu-plugin hidden-user concealment evidence observed during one anonymized client investigation. The narrow topic is wp-user-query.php MU-Plugin Concealing a Stored User ID: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The code is designed to conceal one stored user ID from administrator review. The count mismatch is consistent with that behavior but would not be sufficient evidence on its own.

Investigation context

Anonymized investigation with four screenshots and representative wp-user-query.php plus loader-optimization.php excerpts. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

wp-user-query.php concealed the stored user ID.

Multiple suspicious MU-plugin artifacts were present.

The administrator interface displayed a count mismatch consistent with filtering.

Confirmed findings

• wp-user-query.php reads _pre_user_id.
• It hooks pre_get_users, pre_user_query, and views_users.
• The code excludes the stored ID from listings and adjusts counts.
• A separate loader-optimization.php file was present in the same MU-plugin directory.

Technical analysis

How _pre_user_id moves through three user-view hooks

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

$id = get_option('_pre_user_id');
add_action('pre_get_users', function ($query) use ($id) {
    $query->set('exclude', /* existing exclusions plus $id */);
});
add_action('pre_user_query', /* SQL exclusion shortened */);
add_filter('views_users', /* count adjustment shortened */);

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The code is designed to conceal one stored user ID from administrator review. The count mismatch is consistent with that behavior but would not be sufficient evidence on its own.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

• wp-user-query.php
• WP User Query Filter v3
• _pre_user_id
• pre_get_users plus pre_user_query plus views_users

Contextual indicators

• mu-plugins
• User-count mismatch
• loader-optimization.php
• health-check.php

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

• The retained evidence does not identify how the files were introduced.
• No vulnerable component or affected version was confirmed.
• The excluded loader screenshot contains a live hard-coded token.
• No request log proves the gated loader was used.

Artifact-specific remediation

• Preserve the MU-plugin directory and database option.
• Remove the concealment and loader files after confirming they are not authorized.
• Audit wp_users and wp_usermeta directly rather than trusting the filtered interface.
• Remove unauthorized accounts, invalidate sessions, and rotate credentials.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

• Confirm wp-admin and direct database user inventories agree.
• Monitor mu-plugins and _pre_user_id for recreation.
• Review logs for requests to the removed loader path where available.

Related malware research

Browse the WordPress malware research hub.

• Hidden Administrator Query Hooks Found in functions.php
• WP Compatibility Patch Plugin Creating and Hiding an Administrator
• StateMesh MU-Plugin Self-Copy and Plugin-List Concealment

Related guides and case studies

• How to find hidden WordPress administrators
• Hidden WordPress backdoor investigation
• MU-plugin hidden-user case study

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.