The Admin Menu Editor Pro plugin for WordPress was weaponized after an attacker gained unauthorized access to the developer's infrastructure and distributed trojanized versions to over 200 customers across approximately 1,500 sites. Developer Janis Elsts disclosed that the compromise occurred on Monday when an intruder accessed adminmenueditor.com and deployed version 2.35, which contained an includes/wp-user-consent.php file functioning as a web shell and establishing hidden administrative accounts.

Elsts moved quickly to contain the breach by removing the compromised update and releasing version 2.36 at 19:00 UTC the same day. Unfortunately, the attacker retained access to the website infrastructure and immediately compromised the replacement version as well. The malicious version 2.35 remained available on the official distribution channel from approximately 06:00 to 13:00 UTC.

Admin Menu Editor Pro serves as the premium tier of Admin Menu Editor, a widely deployed WordPress plugin installed on more than 300,000 sites. The plugin provides administrators with capabilities to customize Dashboard menus, restrict plugin visibility to specific users, enforce role-based access controls, and configure login and logout redirects.

According to Elsts, "Based on analysis of update server logs, approximately 230 customers were affected in the initial attack. The malicious version was installed at least 1500 sites (often multiple sites per customer)." He cautioned that the actual scope of the incident may extend further, noting that "Several hundred additional customers downloaded the plugin in or near the relevant time window, and could have also been affected."

Forensic evidence suggests the attacker possessed root-level access to the hosting infrastructure. In response, Elsts took the website offline and kept it unavailable pending a complete restoration. The developer has since published a static information page detailing the incident and providing guidance for affected customers.

Identifying compromised installations

Sites running versions 2.35 or 2.36 of Admin Menu Editor Pro should be inspected for the following artifacts:

  • includes/wp-user-consent.php in the admin-menu-editor-pro directory
  • A new /wp-content/object-cache/ directory
  • A user account beginning with wp_ in the wp_users table, potentially hidden from the WordPress dashboard
  • Options matching the pattern wp_ocache* in the wp_options table

Version 2.34 has been verified as clean, and the free version of Admin Menu Editor does not appear to have been affected by this compromise.

Remediation steps

Elsts recommends that the most dependable recovery method is restoring affected sites from a known-good backup created before September 14. For installations without accessible backups, he suggests removing the plugin entirely, deleting the /wp-content/object-cache/ directory, and purging the malicious database entries identified above.

The developer stated that the breach was confined to the plugin's infrastructure and extended an apology to all impacted customers.