In a concerning cybersecurity incident, the Admin Menu Editor Pro plugin, a popular tool for WordPress users, was exploited, affecting approximately 1,500 websites. This breach originated from a compromise of the plugin maintainer’s website, whereby attackers uploaded a malicious update secretly allowing them backdoor access to the sites of unsuspecting users.
Incident Overview
On September 14, 2026, a malicious actor gained unauthorized access to the adminmenueditor.com website, distributing tainted updates to version 2.35 of the Admin Menu Editor Pro. This update was available to more than 200 customers between 06:00 and 13:00 UTC. The compromised update included a malicious file, includes/wp-user-consent.php, which enabled a web shell installation on affected websites.
Scope of the Compromise
Developer Janis Elsts confirmed that the malicious version was installed on at least 1,500 sites, which may have been multiple installations across various customer accounts. Although Elsts quickly removed the malicious update and released a clean version 2.36 later the same day, the attackers had already retained access and compromised this new version. This incident highlights the vulnerabilities in plugin update mechanisms that can be exploited for wide-scale attacks.
Identifying Compromised Sites
Those who installed versions 2.35 or 2.36 of the Admin Menu Editor Pro should vigilantly check for signs of compromise. Indicators include:
- The presence of includes/wp-user-consent.php in the admin-menu-editor-pro directory.
- A new /wp-content/object-cache/ directory.
- A user account beginning with wp_ in the wp_users table, which may not be visible in the WordPress dashboard.
- An options table entry in wp_options beginning with wp_ocache*.
Elsts noted that version 2.34 is believed to be unaffected, and the free version of Admin Menu Editor appears to remain secure.
Recommended Actions for Affected Users
For users who suspect their sites have been compromised, the developer’s primary recommendation is to restore from a secure backup taken before September 14. If that isn’t feasible, it is advised to:
- Remove the plugin and delete the /wp-content/object-cache/ directory.
- Inspect and remove any of the aforementioned unusual database entries.
Elsts has set up a static page on the adminmenueditor.com site, detailing the breach and offering guidance on protective measures for affected users. The plugin maintainer has since taken their website offline to prevent further access until it can be assured of robustness.
What’s Next?
This incident underscores the ongoing vulnerabilities in WordPress plugin ecosystems, particularly regarding supply chain security. As cyber threats evolve, it becomes imperative for developers to adopt more stringent security measures to mitigate risks associated with compromised updates. Users are advised to remain vigilant and conduct regular audits of their site and installed plugins.
With increasing reliance on third-party tools like Admin Menu Editor Pro, the importance of maintaining a secure backup, performing regular updates, and understanding the implications of plugin vulnerabilities cannot be overstated.
For ongoing protection, WordPress users should also consider enabling security plugins that monitor for unauthorized changes and vulnerabilities. Staying informed about plugin updates and any associated security advisories is equally crucial in safeguarding against such attacks.
