Malicious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

In a significant supply chain security breach, the developer of the widely used Admin Menu Editor Pro plugin for WordPress has confirmed that malicious actors compromised his infrastructure to distribute backdoored updates to thousands of websites. The incident, which unfolded earlier this week, highlights the persistent vulnerabilities inherent in the WordPress plugin ecosystem, where trust in a single developer can inadvertently expose a vast network of enterprise and individual sites to remote code execution and administrative takeover.

The breach centered on the official distribution site for Admin Menu Editor Pro, a premium utility that enables administrators to exert granular control over their WordPress dashboards. By gaining unauthorized access to the server, attackers were able to replace legitimate plugin files with trojanized versions, effectively turning a security-focused tool into a vector for malware deployment.

A Chronology of the Breach

The intrusion was first detected on Monday, September 14, 2026. According to the developer, Janis Elsts, the unauthorized party gained access to the adminmenueditor.com domain and server infrastructure, allowing them to replace the legitimate plugin package with a compromised version, labeled as 2.35.

The timeline of the attack indicates a high level of persistence and coordination:

• Monday, 06:00 UTC: The malicious version 2.35 is pushed to the update server, replacing the legitimate file.
• Monday, 13:00 UTC: The developer identifies the intrusion and removes the malicious update.
• Monday, 19:00 UTC: A "clean" version, 2.36, is released. However, the attackers maintained unauthorized access to the infrastructure and successfully re-compromised this new update shortly after its deployment.
• Post-19:00 UTC: The developer realizes that the threat actors have retained root-level access to the server and decides to take the entire website offline to prevent further distribution of malicious code.

The Anatomy of the Attack

The malicious payload embedded within versions 2.35 and 2.36 was designed to be surreptitious. By modifying the plugin’s core files—specifically by injecting a file titled includes/wp-user-consent.php—the attackers established a functional web shell. A web shell provides a command-and-control interface, allowing the unauthorized party to execute arbitrary commands on the underlying web server, browse the file system, and interact with the site’s database.

Furthermore, the code was configured to create a hidden administrative user account. This tactic is a classic "persistence" mechanism, ensuring that even if the web shell were discovered and deleted, the attacker could still access the site’s backend via the newly created account. By masquerading as an administrator, the threat actor could bypass typical security restrictions, modify content, steal sensitive user data, or use the compromised site to launch further attacks against other targets in the ecosystem.

Scale and Impact Assessment

Admin Menu Editor Pro is the premium iteration of a plugin that boasts an install base of over 300,000 active websites. While the free version, available via the official WordPress repository, appears to be unaffected, the impact on the Pro version’s customer base is substantial.

Current estimates provided by Elsts suggest that at least 230 individual customers installed the compromised updates. Due to the nature of WordPress site management—where many developers or agencies manage multiple domains—this translates to approximately 1,500 compromised websites.

The developer has cautioned that these numbers should be treated as a floor rather than a ceiling. Given the window of opportunity provided to the attackers, it is highly probable that additional users downloaded the trojanized packages during the period when the server was under external control. The difficulty in identifying exactly how many users pulled the update from the compromised source makes a full forensic audit of the incident a complex undertaking.

Developer Response and Remediation

In the immediate aftermath of the discovery, Janis Elsts transitioned the adminmenueditor.com website into a static emergency landing page. This page serves as the primary source of truth for affected customers, outlining the scope of the incident and providing technical guidance on how to sanitize their environments.

The developer has been transparent about the severity of the situation, noting that because the attackers achieved root-level access to his infrastructure, he could not guarantee the integrity of any files served during that period. His official recommendation for remediation is comprehensive:

1. Restore from Backups: The most secure course of action is to perform a full restoration of the website from a clean backup created prior to September 14.
2. Manual Sanitization: If backups are unavailable, administrators are advised to delete the plugin entirely. Additionally, they must manually remove the /wp-content/object-cache/ directory, which may contain malicious persistence files, and scrub the WordPress database of any unauthorized administrator accounts created during the breach window.

Elsts has issued a public apology, citing the incident as a failure of infrastructure security rather than a vulnerability in the plugin’s inherent code logic. He remains focused on ensuring that future updates are deployed through a hardened pipeline.

Broader Implications for the WordPress Ecosystem

The breach of Admin Menu Editor Pro serves as a poignant reminder of the "supply chain" risks inherent in the modern web. WordPress, which powers over 40% of the internet, relies heavily on a third-party ecosystem of plugins and themes. While the official WordPress.org repository has rigorous security reviews, premium plugins sold directly through developer websites—like the Pro version in this case—often operate outside of those centralized oversight mechanisms.

This incident illustrates several critical risks for site owners:

• Trust in Distribution Channels: Even a reputable, long-standing developer can fall victim to a server-side compromise. When the distribution channel itself is poisoned, the security of the end user is entirely bypassed.
• The Speed of Automated Attacks: The fact that the attackers managed to re-compromise the server within hours of the developer pushing a "clean" update suggests that they were actively monitoring the situation and had high-level access to the deployment environment.
• Complexity of Cleanup: For site owners, the cost of this breach extends far beyond the time required to update a plugin. The potential for data theft, the loss of customer trust, and the technical burden of identifying hidden backdoors can cripple smaller web operations.

Security analysts generally recommend that site administrators implement "least privilege" access, maintain robust off-site backups, and utilize file integrity monitoring tools that can alert them when core files are modified unexpectedly. In an era where automated attacks can compromise thousands of sites in a single afternoon, the assumption that a plugin is safe simply because it comes from a known vendor is no longer a viable security strategy.

As of the latest reports, the developer is continuing his investigation into how the root-level access was initially obtained. This forensic process is expected to provide valuable insights into the vulnerabilities that allowed such an expansive breach. Until then, users of Admin Menu Editor Pro are urged to audit their user lists and review file changes immediately, even if they believe they have updated to the latest, clean versions.

The incident serves as a significant wake-up call for the WordPress developer community to bolster their server-side security, implement multi-factor authentication for infrastructure access, and adopt more secure software distribution practices to ensure that updates remain a tool for security rather than a vector for infection.