An attacker compromised the adminmenueditor.com website and pushed malicious updates to the Admin Menu Editor Pro WordPress plugin, specifically version 2.35, which included a web shell in includes/wp-user-consent.php and created hidden user accounts. This malicious update was available from approximately 06:00 to 13:00 UTC on the day of compromise and was installed by about 230 customers on 1,500 sites. The developer released a clean version 2.36 the same day, but the attacker also compromised this version. The attacker likely had root-level server access. The free version of the plugin and version 2.34 are believed to be clean. The developer recommends restoring from backups prior to September 14 or manually removing malicious files and database entries.

The malicious plugin versions installed a web shell and created hidden user accounts, allowing unauthorized access and potential full control over affected WordPress sites. At least 1,500 sites were compromised, with the possibility of more due to the compromised clean update. This backdoor could enable attackers to maintain persistent access, manipulate site content, or use the sites for further attacks.

The developer removed the malicious updates and took the website offline to prevent further compromise. Users who installed versions 2.35 or 2.36 should check for the presence of includes/wp-user-consent.php, a /wp-content/object-cache/ directory, hidden wp_ users in the wp_users table, and wp_ocache* options in the wp_options table. The most reliable remediation is restoring affected sites from backups made before September 14. If restoration is not possible, users should delete the malicious plugin versions, the object-cache directory, and the malicious database entries. Version 2.34 and the free plugin version are not affected.