A rogue admin is an unauthorized administrator account created to keep privileged access after an attacker gets into a system. In WordPress and other web platforms, an admin account can change users, install plugins, edit settings, and sometimes alter code or server-side files. Because of that, a rogue admin is more durable than a stolen password or a single hijacked session: it gives the attacker a standing way back in.
This matters in cyber security because removing the original intrusion does not always remove persistence. Defenders should review administrator lists for unfamiliar names, emails, or creation times, and check whether accounts were added during suspicious logins. In an incident response workflow, rogue admin accounts are often deleted, related sessions are revoked, and logs are searched for account creation, privilege changes, and other follow-on actions. Finding a rogue admin is a strong sign that the attacker intended long-term control, not just one-time access.