Website hack? Closed registration but 2 new users with admin rights

[Delboy2424]

Anyone shed any light on my WP site - two new registrations have appeared and both have admin rights, registered to throwaway gmail accounts.

Registrations are closed off, and there is no log in attempt dates on the timestamp

 

[jaka1]

Backdoor detected

 

[Pepemakingmony]

MySqli?

 

[DropshipDave]

Are you using a nulled theme or plugins?

 

[Delboy2424]

No paid for.

Are you using a nulled theme or plugins?

 

[Deleted member 719276]

Well my dear....

 

[Unreliable Witness]

No paid for.

Out of interest, which ones are they?

 

[TheMarquis]

Go to php admin and delete them. Also, delete any nulled plugin or theme and change your admin dashboard credentials.