MalwarePublished 15 Sep 2026

Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

Source Bleeping Computer

wordpress

Description

Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer's website and pushed updates that created a hidden user account. [...]

Impact

The malicious plugin versions installed a web shell and created hidden user accounts, allowing unauthorized access and potential full control over affected WordPress sites. At least 1,500 sites were compromised, with the possibility of more due to the compromised clean update. This backdoor could enable attackers to maintain persistent access, manipulate site content, or use the sites for further attacks.

Defensive guidance

The developer removed the malicious updates and took the website offline to prevent further compromise. Users who installed versions 2.35 or 2.36 should check for the presence of includes/wp-user-consent.php, a /wp-content/object-cache/ directory, hidden wp_ users in the wp_users table, and wp_ocache* options in the wp_options table. The most reliable remediation is restoring affected sites from backups made before September 14. If restoration is not possible, users should delete the malicious plugin versions, the object-cache directory, and the malicious database entries. Version 2.34 and the free plugin version are not affected.

References

bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Sep 2026, 20:46 UTC

References

Community reviews

Related threats