Finding hidden users on WordPress

Hey there all,

I’m having an issue with my blog that I’m hoping someone can help advise on.

After upgrading it to the latest version I decided to go through my theme and make a few changes.

That’s when I noticed some base64. I cleaned out every single file I saw this in and then noticed that it was even in index files. I went ahead and changed all my passwords and then decided to reupload WordPress.

Going into my settings I noticed that there were 5 admins however only 4 showed up.

I decided to go into PhpMyAdmin and delete almost all users.

Now according to phpmyadmin I’ve got 36 users, however according to my blog admin panel it says there are 886 users.

I don’t know where else to look to find these ‘hidden’ users.

Other comments:
Running Exploit Scanner keeps telling me that it has failed after a bit of scanning.

Looking at the source of the users.php page I only see one user so nothing is hidden.