WordPress user roles: why every extra administrator is a way in

What an administrator can do that nobody else can

WordPress gives each account a role, and each role a set of capabilities. On a single site, only Administrators can install plugins and themes, edit their code in the built-in editors, open the Customizer, and create or promote users (Roles and Capabilities). Installing a plugin means running PHP on your server, so an administrator account is, in practice, the power to run any code.

That's why attacks aim at administrators: a phishing link, a password reused from someone else's breach, a stolen login cookie, a malicious browser extension. Each works against one account. The more administrator accounts there are, the more chances one of them gets used — and an attacker who gets one usually leaves another behind to come back with.

What Click2Shell showed

Click2Shell, found with Claude Opus 5 and a human researcher and written up by pwn.ai, needed no password and no vulnerable plugin to start. An administrator opened a link while signed in. WordPress's own JavaScript in wp-admin pressed Install on a theme from the official directory, and the Customizer preview loaded that theme's PHP without the theme ever being activated. Code in the installed theme then gave the attacker a way to run their own. Editors and lower roles couldn't trigger it, because installing themes needs administrator capabilities.

It is fixed in WordPress 7.1.1, released on 17 September 2026 — update if you haven't. The lesson outlives the bug: when an attack rides an administrator's session, your exposure is the number of people who can be tricked into one click while signed in as one.

Administrators nobody uses

The riskiest administrator is often the one nobody thinks about: the developer who built the site, the agency from two years ago, a colleague who left, a test account. Its password may sit on a list from another site's breach, and if it's misused, nobody notices — no one expects it to sign in, so no one is surprised when it does.

An account that hasn't signed in for three months doesn't need to be an administrator. Remove it, or lower its role until someone actually asks for it back.

How to tell if you have too many

In wp-admin, open Users and click "Administrator" in the filter links above the list. The number next to it is how many accounts can install code. Most sites need one or two: the owner, and whoever maintains the site. For each one, ask: is this a real person, do they still work on the site, and do they need to install plugins or manage users — or only to edit pages, posts or the shop?

WordPress itself doesn't record when someone last signed in, so the Users screen can't tell you who is dormant. You need something that logs sign-ins: an activity-log or security plugin, your host's access logs, or the Relvato plugin with its activity log on (see below). Until you have that, ask the people behind each account.

While you're there, open each administrator's profile and look at "Application Passwords" near the bottom. Each one signs in to the REST API without the login form or two-factor authentication. Revoke any nobody recognises before you change the account.

Give each person the lowest role they need

Security people call this least privilege (OWASP). Editor publishes and manages everyone's posts and pages, comments and media, but can't install plugins or themes, open the Customizer or manage users. On WooCommerce, "Shop manager" runs products, orders, coupons, reports and WooCommerce settings, and can edit customer accounts, but can't install plugins or themes (WooCommerce roles). Author and Contributor are for people who only write.

Editor is less power, not none: on a single site an Editor can still put raw HTML and JavaScript in content (the unfiltered_html capability). Give it to people you'd trust to change the front page.

To change a role: Users → the account → Edit → "Role" → "Update User". For several at once, tick them on the Users list and use "Change role to…". To delete an account instead, choose Delete: WordPress asks what to do with its content — pick "Attribute all content to" and an existing account, so posts and pages aren't lost. Do it from your own administrator account, and keep at least one administrator you can sign in to.

Keep the list short

One named account per person. A shared "admin" login can't be taken away from one person when they leave, and the logs can't tell you who did what.

Temporary access for developers and support. Give a contractor administrator for the job, then lower or remove it when the job is done — put the date in your calendar when you create the account.

Two-factor authentication on every administrator that remains, through a security plugin. It doesn't stop a stolen session, but it does stop a reused password.

A review whenever people change: someone leaves, an agency hands over, a project ends. Each is the moment to open Users and filter by "Administrator" again. Inactive plugins and themes left installed are the other half of the same exposure — Click2Shell ran code from a theme nobody had activated.

How Relvato catches it

Relvato's Admin roster monitor reads the site's administrator accounts through the Relvato WordPress plugin. When there are more than three, the run passes with a warning that says how many and suggests the Editor or Shop manager role. With the plugin's "Activity log and error capture" switched on (Relvato → Settings, plugin 1.56.0 or later), it also records when each administrator signs in, and once sign-ins have been tracked for 90 days, it names every administrator with none in that time. Until then, the run says how many days are left instead of guessing.

Relvato never demotes or deletes an account for you: who should be an administrator is a decision about people, and a deleted account can't be brought back from Relvato. The warning tells you where to do it. If the number is right for your site — a team of five maintainers, say — press "Ignore this warning". The same monitor also flags the more urgent cases: a customer account raised to administrator, an administrator hidden from the Users screen, a new application password.

On the Free plan you press Run whenever you want to check, or schedule it weekly. Pro re-runs your monitors by itself after every update, and the Admin roster as soon as a role changes on the site, so a new administrator shows up the day it appears.