It is time to have a serious discussion about the creaking infrastructure that underlies Wordpress which allows:

• Invisible Users
• Invisible Admin Users
• Invisible Posts
• Invisible Pages
• Invisible Plugins
• Conditional Content with no way to view or search it
• XML-RPC activity by default, with no log, and cannot be disabled without editing a config file
• Loose .htaccess files in subdirectories of /wp-content/.

As a consequence of Wordpress being a swiss army knife that allows the software to be used for Forums, Shopping Carts, and all manner of non-bloggy things, the security situation has gotten completely out of control and it doesn't seem like Wordpress is giving us any tools to fight.

At the very least, Wordpress needs:

• Content Inspector that gives a bird's eye view of content that does not appear under Pages or Posts. Yes I understand people use Wordpress for Forums and Shopping Carts, etc. but there should still be a warts-and-all Content Inspector that lets you at least see and search for content in the database that might be malicious. There should be a judicious warning that deleting unrecognized content could break or cause data loss to third-party plugins.
• Plugin Inspector which gives a bird's eye view of what's going on in /wp-content/plugins/. This would be a sort of File Manager type UI which flags directories and files which might not appear in the Plugins manager. It would display AND flag directories which aren't appearing in Plugins and flag dot (.) files as these shouldn't exist except for one .htaccess in the main dir. Plus git directories of course.
  • It should also be possible to view Multiuser (MU) Plugins and active plugin files from within the Plugin Inspector. None of this shows in subsites.
  • It should flag PHP files in /wp-content/uploads/. Hell, there should be a red banner across your site if a PHP file is found anywhere in /wp-content/uploads/.
• Users Manager Upgrades. There should be a mechanism to display and manage ALL the Users on a Wordpress site. Right now it is trivial to create a phantom/hidden user with Admin access which does not appear in the Users Manager.
• XML-RPC Manager. First, Wordpress should ship with XML-RPC turned off by default. Then, this new UI would allow turning it on and off within the UI, allow setting restrictions to specific whitelisted IP addresses, and finally display a log of recent requests.
• Add Plugin Install/Update Queue. It should not be possible for an AJAX session alone to install or reinstall a plugin without any user intervention. All plugins should be required to be added to an install queue which has visibility in the Wordpress UI. Right now, plugin updates/installs happen behind the scenes with no visibility so you can clean up a site and be immediately reinfected. It needs to be possible to view as well as pause or stop the Plugin Install Queue.
• Add a "Close All Admin Sessions" button which kicks every Admin out and requires them to relogin.

If you're wondering why all these suggestions are necessary, read this link:

https://www.reddit.com/r/Wordpress/s/LhMnsJzBnW

It is now a relatively commonplace thing for a vulnerable plugin to install phantom plugins, create phantom users and grant them admin access, and then add phantom posts and pages which get indexed by Google and drive traffic all without ANY visibility within the Wordpress Admin UI. It's all completely invisible.

P.S. I wrote this myself. F--- AI.