Malicious updates for the premium WordPress plugin Admin Menu Editor Pro were delivered from the vendor’s own website, backdooring at least 1,500 customer websites. The attacker compromised adminmenueditor.com and replaced versions 2.35 and later 2.36 with trojanized builds that added includes/wp-user-consent.php, created a hidden WordPress user, and installed a web shell for persistent remote access. The free Admin Menu Editor plugin was not affected, and version 2.34 is believed clean.
Why it matters: Website owners using Admin Menu Editor Pro should treat this as urgent because attackers may already have hidden administrator access and remote control of affected sites. Anyone who installed versions 2.35 or 2.36 should check for the listed indicators of compromise and restore from a known-good backup or remove the backdoor artifacts immediately.
Bill Toulas
2026.09.15
100% relevant
This article establishes a distinct new supply-chain compromise affecting Admin Menu Editor Pro, with specific malicious versions, vendor infrastructure compromise, and a known scope of impacted customer sites.
← Back to all stories