DE

↑ ↓ select, Enter open, Esc close

Show recently registered WordPress users

harmlessWP-CLIalle
Adjust the values, the command updates live
user@server
wp user list --orderby=registered --order=DESC --fields=ID,user_login,user_email,user_registered,roles --path=/var/www/vhosts/example.com/httpdocs | head -n 15

Sorts all users by registration date, newest first, and shows the first entries. After a breach, attackers often create an additional administrator account, which shows up at the top with a recent date. Suspicious accounts can then be removed with wp user delete.

Note: Attackers can fake user_registered directly in the database. Always check unknown administrators by role as well.

Also searched as

  • unknown admin user in wordpress
  • wordpress hacked find rogue users
  • new users since yesterday wordpress

Related one-liners

All in WP-CLI

List all WordPress administrators

$wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --path=/var/www/vhosts/example.com/httpdocs
harmlessWP-CLI

Change the role of a WordPress user

$wp user set-role editorial editor --path=/var/www/vhosts/example.com/httpdocs
cautionWP-CLI

Check WordPress core files for tampering

$wp core verify-checksums --path=/var/www/vhosts/example.com/httpdocs
harmlessWP-CLI

Compare plugin files with the originals from wordpress.org

$wp plugin verify-checksums --all --path=/var/www/vhosts/example.com/httpdocs
harmlessWP-CLI

Create a new WordPress administrator

$wp user create emergencyadmin admin@example.com --role=administrator --path=/var/www/vhosts/example.com/httpdocs
cautionWP-CLI

List all WordPress users with their roles

$wp user list --fields=ID,user_login,user_email,roles --path=/var/www/vhosts/example.com/httpdocs
harmlessWP-CLI

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.