Clarissa Hana
A severe security incident has impacted users of the popular Admin Menu Editor Pro WordPress plugin, with malicious versions distributed to an unknown number of customers, potentially affecting over 1,500 websites. Threat actors successfully compromised the plugin maintainer’s website, injecting malicious code that created hidden user accounts and web shells on affected sites. The developer, Janis Elsts, has taken the plugin’s website offline to investigate and secure the infrastructure.
The breach was first detected on Monday when an unauthorized party gained access to the adminmenueditor.com website. The attacker subsequently uploaded version 2.35 of the Admin Menu Editor Pro plugin, which contained a malicious file named includes/wp-user-consent.php. This file acted as a web shell, granting the attacker unauthorized access to the backend of compromised WordPress installations. This exploit allowed for the creation of hidden administrative user accounts, a common tactic for maintaining persistent access to a website.
Following the discovery of the intrusion, Elsts promptly removed the compromised version 2.35 and released a clean update, version 2.36, on the same day at approximately 19:00 UTC. However, the threat actor managed to retain access to the website’s infrastructure and subsequently compromised the newly released version as well, highlighting the sophistication and persistence of the attack.
Admin Menu Editor Pro is a premium add-on for the widely used Admin Menu Editor plugin. The free version of Admin Menu Editor boasts over 300,000 active installations on WordPress sites and offers administrators extensive control over their WordPress dashboard. Its features include the ability to customize the admin menu, hide specific plugins from other users, implement role-based access restrictions, and configure custom login and logout redirects. The Pro version likely offers even more advanced customization options, making it a valuable tool for users seeking to tailor their WordPress experience.
Timeline of the Attack and Mitigation Efforts
The malicious version 2.35 of Admin Menu Editor Pro was reportedly available for download from the official website for a significant period, approximately between 06:00 and 13:00 UTC on Monday. During this window, the malicious PHP code within the plugin was executed on any site that updated to this version, leading to the establishment of backdoors and hidden user accounts.
The developer has provided an estimated number of affected customers and sites. "Based on analysis of update server logs, approximately 230 customers were affected in the initial attack," Elsts stated in his communication. "The malicious version was installed at least 1500 sites (often multiple sites per customer)." He further cautioned that the total number of victims could be considerably higher, as it is challenging to definitively track all installations of the subsequently compromised version 2.36. "Several hundred additional customers downloaded the plugin in or near the relevant time window, and could have also been affected," he added.
The investigation into the breach revealed that the attacker likely possessed root-level access to the server hosting the plugin’s website. This level of access indicates a highly sophisticated and potentially devastating compromise. In response to the severity of the situation and to ensure the integrity of the platform, Elsts made the difficult decision to take the entire adminmenueditor.com website offline. This measure is intended to prevent further unauthorized access and to allow for a thorough and secure restoration of the website and its services.
Broader Context: WordPress Security and Plugin Vulnerabilities
WordPress, powering over 40% of all websites on the internet, is a prime target for cybercriminals due to its widespread adoption and the vast ecosystem of plugins and themes. While the platform itself is generally secure, vulnerabilities can arise from third-party extensions, weak user credentials, or compromised hosting environments. This incident underscores the critical importance of robust security practices for both plugin developers and website administrators.
The Admin Menu Editor Pro compromise is not an isolated event. In the past, numerous WordPress plugins have been found to contain security flaws, ranging from cross-site scripting (XSS) vulnerabilities to critical remote code execution (RCE) flaws. These vulnerabilities can be exploited by attackers to gain unauthorized access, inject malware, or deface websites. The plugin ecosystem’s complexity means that a single compromised plugin can have a cascading effect, affecting a large number of users.
Official Response and Customer Guidance
In the aftermath of the incident, Elsts has published a static page on the plugin’s website providing detailed information about the security breach. This page serves as a crucial resource for affected customers, offering guidance on how to identify signs of compromise and outlining recommended steps for remediation. The developer has also provided a direct link to this advisory: https://adminmenueditor.com/blog/security-incident-affecting-customers-2026-09-14/.
Customers who have installed versions 2.35 or 2.36 of Admin Menu Editor Pro are urged to meticulously check their websites for specific indicators of compromise. While the exact list of checks was not fully detailed in the provided text, common signs of such a compromise include the appearance of unexpected administrative users, modified website files, the presence of unknown PHP scripts, and unusual database entries.
The developer emphasizes that the most reliable method to secure a compromised website is to restore it from a known clean backup created before September 14th. This date is critical as it predates the period during which the malicious versions were active. If restoring from a backup is not feasible, Elsts provides alternative recommendations. These include the complete deletion of the Admin Menu Editor Pro plugin, the removal of the /wp-content/object-cache/ directory (which may have been used for persistence), and the deletion of any suspicious database entries identified during an investigation.
Elsts has expressed his apologies to all affected customers, acknowledging the significant disruption and concern caused by the incident. He reiterated that the breach was limited to the plugin’s infrastructure and did not stem from a vulnerability within the core WordPress software itself. The free version of Admin Menu Editor has not been reported as affected, and version 2.34 of the Pro plugin is believed to be clean.
Analysis of Implications and Future Recommendations
The Admin Menu Editor Pro incident serves as a stark reminder of the persistent threats facing the WordPress ecosystem. The ability of threat actors to compromise developer websites and distribute malicious updates highlights a critical vulnerability in the software supply chain. This type of attack can be particularly damaging as users inherently trust updates from official sources.
The implications for affected businesses and individuals are significant. Compromised websites can lead to data breaches, financial losses through fraudulent transactions, damage to reputation, and legal liabilities. The creation of hidden user accounts by the attacker suggests a motive of long-term control and potential monetization through various illicit activities.
This incident underscores the importance of several key security best practices for WordPress users:
- Regular Backups: Maintaining frequent, off-site backups is the most effective safety net against data loss and the impact of security breaches.
- Plugin and Theme Audits: Regularly review installed plugins and themes. Remove any that are no longer necessary or have not been updated recently.
- Update Management: While updates are crucial for security, users should exercise caution. Ideally, updates should be tested on a staging environment before being applied to a live site.
- Strong User Credentials: Employing strong, unique passwords for all WordPress accounts, especially administrative ones, is fundamental. Two-factor authentication (2FA) adds another critical layer of security.
- Security Plugins: Utilizing reputable WordPress security plugins can help detect and prevent malware, brute-force attacks, and other malicious activities.
- Vigilance: Staying informed about security advisories and potential vulnerabilities related to the plugins and themes in use is essential.
The developer’s swift action to take the website offline and provide clear guidance demonstrates a commitment to customer safety, even amidst a significant crisis. However, the incident will likely prompt a broader re-evaluation of security protocols within the WordPress plugin development community. Developers must implement more robust measures to protect their infrastructure from unauthorized access and to ensure the integrity of their update distribution mechanisms. The trust placed in these developers by millions of users worldwide is paramount, and incidents like this can erode that trust if not handled with transparency and decisive action. The road to full recovery for affected users will involve diligent investigation, meticulous cleanup, and a renewed focus on proactive security measures to safeguard against future threats.
