"Based on analysis of update server logs, approximately 230 customers were affected in the initial attack," Janis Elsts told BleepingComputer.
How adminmenueditor.com was used to push trojanized updates
The WordPress plugin Admin Menu Editor Pro was trojanized after an unauthorized party gained access to the maintainer’s website, adminmenueditor.com. The attacker uploaded a malicious update labelled version 2.35 for the plugin’s Pro edition that included a file named includes/wp-user-consent.php which installed a web shell on affected sites and also created a hidden user account.
The developer, Janis Elsts, removed that malicious update and published a clean version 2.36 at 19:00 UTC on the same day. However, Elsts said the hacker retained access to the website and compromised the new version as well.
Which versions and editions were affected
- Malicious versions: Admin Menu Editor Pro 2.35 and a trojanized 2.36
- Version believed clean: 2.34
- Free edition: the free version of Admin Menu Editor does not appear to be affected
The malicious 2.35 update was available on the official website for approximately 06:00 to 13:00 UTC, according to Elsts' account to BleepingComputer.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleScope: customers, sites, and attacker's access
Elsts reported that approximately 230 customers downloaded the malicious update in the initial attack and that the compromised plugin was installed on at least 1,500 sites—often multiple sites per customer. Elsts cautioned the actual number could be larger, because "several hundred additional customers downloaded the plugin in or near the relevant time window, and could have also been affected," and because it is difficult to determine how many customers ran a trojanized version 2.36.
The investigation indicates the attacker likely had root-level server access to the maintainer's infrastructure. Because of that suspected level of access, Elsts decided to take the adminmenueditor.com website offline until it could be restored with confidence and has published a static page with incident details and customer guidance.
Indicators of compromise and recommended remediation steps
Elsts published a concise checklist for administrators to detect signs of compromise on sites that installed Admin Menu Editor Pro versions 2.35 or 2.36. The signs to look for are:
- Presence of includes/wp-user-consent.php in the admin-menu-editor-pro directory
- A new /wp-content/object-cache/ directory
- A user beginning with wp_ in the wp_users table, which may be hidden from the WordPress dashboard
- Options named like wp_ocache* in the wp_options table
Elsts stated the most reliable fix is to restore a compromised site from a safe backup created before September 14. If a pre-September 14 backup is not available, the developer recommended deleting the plugin, removing the /wp-content/object-cache/ directory, and removing the indicated database entries.
What this means for plugin users, hosting providers, and developers
- Plugin users (Admin Menu Editor Pro customers): Check for the specific indicators Elsts listed. If you find them, restore from a backup before September 14 where possible; otherwise remove the plugin, the object-cache directory, and the wp_ocache* options as recommended.
- Managed hosting providers and site administrators: Be aware that multiple sites per customer may have been affected and that hidden accounts or object-cache artifacts may not be visible in the WordPress dashboard—inspection at the file system and database level is required.
- Plugin developers and maintainers: The incident highlights the consequences of a compromised distribution point: a single compromised update pushed to customers can create a web shell and hidden accounts. Elsts' response included taking the website offline and publishing guidance; maintainers should plan for incident containment and public advisories.
Elsts apologized to affected customers and is attempting to restore the website with confidence. The developer also warned that because the new 2.36 release was compromised after being published, the full extent of affected installations remains uncertain.
The record that Elsts provided to BleepingComputer gives concrete detection artifacts and a clear recovery recommendation, but leaves the total number of impacted sites unresolved: Elsts' analysis shows at least 230 customers and 1,500 installations, and the developer has warned the true count could be larger.
