In Chrome, go to chrome://extensions/, enable Developer mode using the toggle in the top-right, then click the “Load unpacked ...
A critical flaw in a WordPress add-on was recently patched, which allows crooks to add a rogue admin account to the site.