OK, this is pretty scary. For years people have said to not make a “Root User” (a user that can control everything on your Mac). However, in High Sierra Apple has left creating a “Root User” wide open. If someone can access an unlocked Mac, they can make a “Root User” account and do all kinds of stuff on your Mac. This article explains how this can be done. The only way to fix this at this point is make your own “Root User” account with your own password.
PS!! Apple has already released a Security Update to fix this. That didn’t take long did it! The update can be installed through the App Store, do a Restart after it is installed.