A WordPress Administrator is the most privileged role on a single-site WordPress installation. Administrators can manage users, change site settings, install or remove themes and plugins, and alter core security-relevant configuration. In practice, this role controls the entire application.
That makes Administrator accounts a prime target in cyber attacks. If an attacker can impersonate or escalate into this role, they may be able to create new accounts, add malicious plugins, change authentication settings, or take over the site completely. Defenders should limit how many users receive this role, protect administrator logins with strong authentication, and review privileged account mappings carefully when using SSO or federation. Any flaw that lets an attacker reach an Administrator session is usually a full-site compromise risk.