The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker derives the standard admin pages are on your server, logs in with default passwords, and start playing with the website. This is the kind of Web security risk :

Security Misconfiguration includes leaving default configurations unchanged: default admin accounts, default passwords, demo pages, or unused services installed. Attackers know these defaults and use them to gain unauthorized access. The scenario describes exactly this - default admin console with default credentials unchanged.