Hacker Backdoored a WordPress Plugin's Own Website, Hitting 1,500 Sites

Key points

• An attacker broke into adminmenueditor.com on Monday and pushed a booby-trapped version 2.35 of Admin Menu Editor Pro.
• Developer Janis Elsts confirmed roughly 230 customers installed the poisoned update across at least 1,500 sites.
• The malicious version was live from about 06:00 to 13:00 UTC; a replacement 2.36 was also tampered with because the attacker still had access.
• The update dropped a web shell (a hidden file that lets an attacker run commands on the server) and created a hidden admin account.
• Version 2.34 is believed clean, and the free Admin Menu Editor plugin is not affected.

A WordPress plugin used to tidy up the admin dashboard was turned against its own customers this week, after someone broke into the developer's website and swapped the real update for a malicious one.

Admin Menu Editor Pro is the paid version of a tool installed on more than 300,000 WordPress sites. It lets site owners rearrange the admin menu, hide plugins from junior staff, and control per-role access. Developer Janis Elsts published a full incident notice explaining what happened. On Monday, an unauthorised party accessed adminmenueditor.com and uploaded a fake version 2.35. That version included includes/wp-user-consent.php, a web shell that let the attacker run commands on any site that installed it, and it quietly created a new administrator account.

Elsts spotted the tampering and pushed what he thought was a clean 2.36 the same day at 19:00 UTC. The attacker was still inside the site and poisoned that version too.

How bad is it for site owners?

At least 230 paying customers installed the malicious update across roughly 1,500 sites, many customers running the plugin on several sites at once. Several hundred more downloaded the plugin during the same window and could also be affected.

Elsts told BleepingComputer the poisoned 2.35 was available from approximately 06:00 to 13:00 UTC. He's since taken the website offline while it's rebuilt, because the investigation suggests the attacker had root-level access, meaning full control of the server. It's the same playbook we saw in August, when hijacked BdThemes plugins quietly spawned hidden admin accounts across sites running Element Pack and related tools.

What should affected customers check?

Anyone running Admin Menu Editor Pro 2.35 or 2.36 should look for four specific traces of the backdoor.

Where to look	What to look for
Plugin folder	A file at admin-menu-editor-pro/includes/wp-user-consent.php
WordPress files	A new /wp-content/object-cache/ directory
wp_users database table	A user whose name starts with wp_, possibly hidden from the dashboard
wp_options database table	Entries named like wp_ocache*

Version 2.34 is believed clean. The free Admin Menu Editor plugin from the WordPress.org repository doesn't appear to be involved.

What should victims actually do?

Restore from a backup taken before 14 September, if you have one. Elsts says that's the only fix he trusts, because a web shell plus a hidden admin account gives the attacker room to leave other surprises behind.

If you can't restore, delete the plugin and the /wp-content/object-cache/ directory, remove the rogue database entries above, reset every administrator password, and rotate any API keys the site holds. On 14 September we also reported that WordPress is now scanning every plugin update for malicious code, though that check covers the official repository, not a developer's own download server.

Should you worry about auto-updates?

This attack is the clearest argument yet for treating auto-updates as a conditional trust rather than a blanket safety net. When the source of updates is compromised, the update mechanism becomes the delivery route. Keep clean, reachable backups, and know which of your plugins fetch updates from a private server rather than WordPress.org.