An administrator session is the authenticated WordPress state that proves a user has already logged in and is allowed to perform high-privilege actions. In practice, it is usually maintained by browser cookies and server-side checks that keep the user recognized as an admin without re-entering credentials for every request.
This matters because a stolen or hijacked admin session can bypass passwords, multi-step approvals, and even some account recovery steps. An attacker who controls the session can change site settings, add or remove users, install or modify plugins, edit content, or plant persistence such as rogue accounts and web shells. Defenders treat active sessions as sensitive assets: they revoke sessions after compromise, review recently authenticated admin accounts, enforce strong authentication, and monitor for unusual administrative actions from unexpected IPs or devices.