A serious supply-chain attack is affecting WordPress users , as a malicious version of the popular Admin Menu Editor Pro plugin was distributed through the developer's official infrastructure. According to developer Janis Elsts , an attacker managed to gain access to the plugin's distribution website and replace legitimate updates with modified versions.
The incident is particularly significant because users did not have to visit a suspicious website or download a file from an unknown source. The malicious update appeared as a regular update, exploiting the trust that WordPress administrators have in the software they use.
How the attack started
According to the plugin's creator, on Monday an unauthorized user gained access to adminmenueditor.com and uploaded version 2.35 of Admin Menu Editor Pro. This version contained modified PHP codethat was not part of the legitimate functionality of the plugin.
Specifically, the package contained the file includes/wp-user-consent.php, which could install a web shell on the compromised WordPress site. At the same time, the malicious code created a hidden user account, offering the attacker another access mechanism.
Version 2.35 remained available for several hours, from approximately 06:00 to 13:00 UTC, before the incident was detected and withdrawn.
Admin Menu Editor Pro – Clean version hacked again
The incident didn't stop there, however. Elsts removed the malicious version and released 2.36, which was supposedly clean, at around 19:00 UTC that same day.
The attacker appears to still have access to the developer's infrastructure and was able to compromise the new version. This suggests that the initial restoration of the website was not enough, as the underlying infrastructure used to distribute the updates remained under the attacker's control.
The developer estimated that the attacker likely had root-level access to the server, which led to the decision to temporarily take the distribution website down.
Over 230 clients and 1,500 websites
The true scale of the attack is significant. Based on analysis of update server logs, approximately 230 customers installed the malicious version, which was found on at least 1,500 websites.
This number is likely to be higher, as hundreds more customers downloaded the plugin during or near the time window of the attack. Additionally, a customer may manage more than one WordPress site, significantly increasing the number of potentially affected installations.
The Admin Menu Editor is used on over 300,000 websites, which explains why a breach of the premium version can create a wider risk.
Why the plugin was an attractive target
The Admin Menu Editor allows administrators to modify the WordPress Dashboard, hide plugins and options from specific users, apply role-based restrictions, and configure login and logout behaviors.
Because such a plugin operates at the WordPress admin level, installing a modified version can have serious consequences. An attacker who gains access with elevated privileges could attempt to maintain persistent access, modify files, create new users, or use the site as a base for further attacks.
How administrators can control WordPress sites
Administrators who installed versions 2.35 or 2.36 should immediately examine their installations for signs of a breach.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Specifically, it is recommended to check the presence of the file includes/wp-user-consent.php within the plugin folder, as well as the existence of the directory /wp-content/object-cache/.
At the same time, you should examine the wp_users for unknown accounts that start with wp_, which may not appear normally in the WordPress Dashboard. You should also check the wp_options for suspicious entries with names like wp_ocache*.
The presence of any of these elements should not be taken lightly. If there is any indication of compromise, a check of the logs, administrator accounts , and website files is required.
Which version is considered safe?
According to the creator, version 2.34 is considered safe, while so far there are no indications that the free version of Admin Menu Editor was affected.
For those who have installed the affected versions, the recommended solution is to restore the website from a safe backup created before September 14.If this is not available, Elsts suggests removing the plugin, the object-cache directory, and suspicious entries from the database.
However, in the event of a confirmed breach, simply deleting files is not necessarily enough. Passwords, administrator accounts, API keys, and any other access mechanisms that may have been exposed should be checked.
Another lesson in WordPress security
The Admin Menu Editor Pro incident highlights one of the most difficult risks of the modern WordPress ecosystem: even an update coming from the official vendor is not automatically a guarantee of securityif the distribution infrastructure has been compromised.
For administrators, this means that backups should be frequent and audited, plugins should be limited to the bare essentials, and administrative accounts should be protected with strong multi-factor authentication.
The creator of Admin Menu Editor has apologized to the affected customers and is continuing to restore the infrastructure. The incident, however, is a reminder that the security of a website depends not only on the code itself that the administrator installs, but also on the security of the entire chain through which this code is distributed.
source: www.bleepingcomputer.com
