A supply chain attack has compromised the “Pro” version of Admin Menu Editor, a popular WordPress plugin used for customizing dashboard interfaces. Malicious code was discovered in versions 2.35 and 2.36, which were distributed through the developer’s official website. While initial assessments suggested a smaller impact, investigation into update server logs confirmed that approximately 1,500 WordPress sites across 230 customers received the backdoored updates.
The developer of the plugin, Janis Elsts, reported that the attacker likely gained root-level access to the update server. This allowed the threat actor to maintain persistence even after an initial remediation attempt. When Elsts released version 2.36 on September 14 to address the breach, the attacker immediately compromised the new version, resulting in a “double compromise” that necessitates thorough manual inspection for all Pro users.
Identifying the Backdoor and Web Shell
Because the compromise involves server-level persistence and the creation of hidden accounts, simply deleting and reinstalling the plugin may not be sufficient to secure an affected site. Site administrators should check for three specific indicators of compromise:
- Malicious File: The backdoor installs a web shell located at
wp-content/plugins/admin-menu-editor-pro/includes/wp-user-consent.php. This file allows the attacker to execute arbitrary code on the server. - Hidden Admin User: The script creates a new administrator account. These accounts typically follow a naming convention starting with
wp_followed by a string of hexadecimal characters. These users may be hidden from the standard WordPress dashboard user list. - Database Persistence: The malicious payload may add a
wp_ocacheentry to the WordPress options table to maintain its configuration or state.
According to a security advisory from Patchstack, the backdoor in versions 2.35 and 2.36 allows for full site takeover. Administrators who installed these specific versions between September 12 and September 14 should assume their environment is compromised.
Remediation and Safety of the Free Version
The breach was limited to the developer’s private infrastructure used for distributing the Pro version. The free version of Admin Menu Editor, which is hosted on the official WordPress.org repository, was not affected and remains safe to use. The supply chain attack specifically targeted the premium update mechanism.
As of September 16, the maintainer’s website, adminmenueditor.com, has been taken offline while the infrastructure is rebuilt from scratch to ensure no traces of the attacker remain. Janis Elsts has advised all affected Pro customers to restore their websites from a backup created before September 14.
If a backup is unavailable, administrators must manually delete the malicious wp-user-consent.php file, remove any unrecognized administrative users from the database, and clear the wp_ocache option. Once the developer’s site is back online, users should update to a verified clean version. Following a cleanup, it is also recommended to rotate all WordPress salts, database passwords, and administrative credentials, as the presence of a web shell suggests that any sensitive data on the server could have been exfiltrated.
