Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
Malicious Admin Menu Editor Pro plugin updates backdoor 1,500 WordPress sites.
A threat actor compromised the Admin Menu Editor Pro plugin's website, pushing malicious updates that created hidden user accounts and installed web shells on over 1,500 WordPress sites. The developer attempted to remove the malicious code, but the attacker re-compromised the site and the updated plugin. The website has been taken offline for restoration, and users are advised to restore from backups or manually remove malicious files and database entries.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Admin Menu Editor Pro?
Get an email when a new story names Admin Menu Editor Pro, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA threat actor gained access to the Admin Menu Editor Pro plugin's distribution infrastructure and pushed trojanized updates that silently installed web shells and created hidden admin accounts on over 1,500 WordPress sites. This is a classic software supply chain attack — users trusted a legitimate update channel, not knowing the source had been compromised. The developer's initial remediation failed because the attacker retained persistent access and re-compromised the site, highlighting the danger of incomplete incident response. This incident underscores why blindly auto-updating third-party plugins without integrity verification can be as dangerous as running outdated software.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — wp-user-consent.php