Compromised Admin Menu Editor Pro Updates Backdoor About 1,500 WordPress Sites
Summary
An attacker compromised the Admin Menu Editor Pro website and pushed malicious versions 2.35 and 2.36, installing a web shell and hidden accounts. At least 230 customers across about 1,500 sites were affected; users are urged to check and restore from a safe backup.
Key points
- An unauthorized party accessed the plugin maintainer’s website and used it to distribute malicious Admin Menu Editor Pro updates.
- Version 2.35 installed a web shell and created a hidden user account on affected WordPress sites.
- After the developer replaced version 2.35 with a clean 2.36 release, the attacker still had access and compromised 2.36 as well.
- The developer reported at least 230 affected customers and about 1,500 sites; the actual impact could be higher.
- Signs of compromise include includes/wp-user-consent.php, a new /wp-content/object-cache/ directory, hidden wp_ users, and wp_ocache* database options.
- Version 2.34 is believed to be clean, and the free plugin version does not appear to be affected.
- The developer recommends restoring from a safe backup made before September 14; if that is not possible, remove the plugin and identified files and database entries.
Article Details
- Victim Organization
- Admin Menu Editor Pro maintainer's website and affected customer WordPress sites
- Victim Domain
- adminmenueditor.com
- Incident Type
- Compromise of a plugin maintainer website and distribution of malicious plugin updates
- Affected Records
- At least 230 customers; malicious versions were installed on at least 1,500 sites. The total may be higher.
- Operational Impact
- Malicious plugin versions 2.35 and 2.36 created hidden user accounts and deployed a web shell on affected sites. The maintainer took the website offline while working to restore it.
- Claim Status
- confirmed
MITRE ATT&CK
T1136.001 · Local AccountThe malicious plugin code created a hidden user account on affected WordPress sites.T1195.002 · Compromise Software Supply ChainThe attacker compromised the plugin maintainer's website and used it to distribute malicious plugin updates.T1505.003 · Web ShellVersion 2.35 included a file that installed a web shell on affected sites.
People
Products
Admin Menu Editor ProA compromised Admin Menu Editor Pro website pushed malicious plugin updates to WordPress customers, creating hidden user accounts and deploying a web shell on affected sites.WordPressA compromised Admin Menu Editor Pro website pushed malicious plugin updates to WordPress customers, creating hidden user accounts and deploying a web shell on affected sites.