That is very weird. There is no known security issue in xenforo that will allow that. Have you installed any mods lately or made some other kind of modification to your forum?
I think I found
I received a paypal and this member is placed automatically in the admin group.
I do not know how to find the paypal link and I have not quite seen the list of groups. View attachment 45346
sorry for disturbing atmosphere .
problem solved
If its PayPal related to purchasing an upgrade, I would check your settings for any paid upgrades you've defined. But as Brogan said above, you can only add administrators / moderators through the ACP and they won't have complete access to your site except as defined in Usergroup Permissions.