A malicious version of the Admin Menu Editor Pro plugin for WordPress was distributed to over 200 customers, affecting at least 1,500 websites, after an attacker compromised the maintainer's website and pushed updates containing a backdoor. The incident, which began on Monday, September 14, involved the distribution of trojanized versions of the premium plugin.
According to developer Janis Elsts, an unauthorized party gained access to the adminmenueditor.com website and uploaded version 2.35 of the plugin as an update. This version, available from approximately 06:00 to 13:00 UTC on September 14, included a file named `includes/wp-user-consent.php`. This file installed a web shell on affected websites and created a hidden user account in the `wp_users` table, typically prefixed with `wp_`.
After discovering the intrusion, Elsts removed the malicious update and released a clean version 2.36 at 19:00 UTC on the same day. However, the attacker still maintained access to the website and subsequently compromised this new version as well. The developer indicated that the attacker likely achieved root-level server access.
The Admin Menu Editor Pro plugin is the premium counterpart to the free Admin Menu Editor, which is installed on over 300,000 WordPress sites. The plugin allows administrators to customize dashboard menus, manage plugin visibility, set role-based access limits, and configure login/logout redirects. The free version of the plugin is not believed to have been affected.
Based on an analysis of update server logs, approximately 230 customers initially installed the malicious version 2.35, impacting at least 1,500 sites. The developer warned that the total number of affected customers could be higher, as it is difficult to precisely determine how many also installed the compromised version 2.36. Several hundred additional customers downloaded the plugin around the time of the attack and could also be affected.
To protect customers, Elsts took the adminmenueditor.com website offline, replacing it with a static page detailing the incident and providing guidance for affected users. The developer recommends that anyone who installed Admin Menu Editor Pro versions 2.35 or 2.36 check for specific indicators of compromise. These include the presence of `includes/wp-user-consent.php` within the `admin-menu-editor-pro` directory, a new directory named `/wp-content/object-cache/`, and options in the `wp_options` table named similar to `wp_ocache*`.
The most reliable remediation advised is to restore the compromised site from a backup created before September 14. If a backup is unavailable, Elsts recommends deleting the plugin, the `/wp-content/object-cache/` directory, and the malicious database entries. Version 2.34 of the plugin is considered clean. The developer has confirmed that the incident was limited to their infrastructure and has apologized to affected customers.
