A recent security incident has seen a popular **WordPress** plugin, **Admin Menu Editor Pro**, compromised, leading to the backdoor installation on an estimated 1,500 websites. The attack involved an unauthorized party gaining access to the developer's infrastructure and pushing malicious updates. ### The Supply Chain Compromise Developer **Janis Elsts** reported that an attacker gained control of the adminmenueditor.com website on a Monday, subsequently uploading a trojanized version 2.35 of the **Admin Menu Editor Pro** plugin. This update included a file, `includes/wp-user-consent.php`, designed to install a web shell on affected sites. Upon discovering the intrusion, **Elsts** swiftly removed the compromised update and issued a clean version 2.36. However, the attacker retained access, leading to the compromise of this subsequent clean release as well. ### Widespread Impact and Hidden Accounts **Admin Menu Editor Pro** is the premium counterpart to the free **Admin Menu Editor** plugin, which boasts over 300,000 active installations. The malicious versions (2.35 and 2.36) were available for a limited time, but during this window, at least 230 customers installed the tainted software across 1,500 sites. These malicious updates not only installed web shells but also created hidden user accounts within the **WordPress** database, providing persistent access to the attackers. **Elsts** warned that the actual number of affected sites could be higher, as tracking installations of the compromised version 2.36 is challenging. ### Developer's Response and Remediation Given the suspected root-level server access by the attacker, **Elsts** made the critical decision to take the official website offline to prevent further compromise and facilitate a secure restoration. A static page has been published by **Elsts** detailing the incident and providing crucial guidance for affected users. **Elsts** has outlined specific indicators of compromise (IOCs) for users to check their installations: * Presence of `includes/wp-user-consent.php` within the `admin-menu-editor-pro` directory. * Existence of a new `/wp-content/object-cache/` directory. * A user starting with `wp_` in the `wp_users` table, which might be hidden from the **WordPress** dashboard. * Options named `wp_ocache*` in the `wp_options` table. Version 2.34 of the plugin is considered safe, and the free version of **Admin Menu Editor** remains unaffected. For remediation, the most reliable solution is to restore websites from a backup created before September 14. If a backup is unavailable, **Elsts** recommends deleting the plugin, the `/wp-content/object-cache/` directory, and the identified database entries. The developer has apologized for the incident, emphasizing that the breach was limited to their infrastructure and not the plugin's code itself prior to the compromise.