Trojanized Admin Menu Editor Pro Backdoors 1,500 WordPress Sites

A severe software supply chain attack has struck the WordPress ecosystem after threat actors compromised the official infrastructure of Admin Menu Editor Pro, a popular commercial plugin used by site administrators to customize WordPress dashboards. The developer, Janis Elsts, disclosed that adversaries obtained root-level access to the primary hosting server (adminmenueditor.com), allowing them to upload trojanized release archives that distributed persistent web shells and backdoor accounts across more than 1,500 WordPress websites.

The intrusion compromised plugin version 2.35 and subsequent re-release version 2.36 on September 14, 2026. Because the trojanized packages were delivered directly through the plugin's legitimate automatic update mechanism, downstream WordPress installations automatically ingested and executed the malicious code without triggering customary firewall or hash mismatch alerts.

Technical Analysis

The threat actor executed a multi-tiered persistence strategy inside downstream WordPress environments by abusing core Content Management System (CMS) hooks and caching directories:

Trojanized Archive Injection

The adversary substituted the legitimate admin-menu-editor-pro.zip package with an altered archive containing a stealth loader script:

• Injected Payload Component: A new file, includes/wp-user-consent.php, was introduced directly into the plugin codebase.
• Automated Web Shell Dropper: Upon plugin activation or background execution, this script dynamically creates a hidden directory inside the standard WordPress caching structure at /wp-content/object-cache/<hex_directory>/ and writes a standalone PHP web shell named with randomized hexadecimal characters.
• Database Pollution: The malware inserts obfuscated operational configurations into the wp_options database table, utilizing option keys prefixed with wp_ocache or _wp_ocache_.

Stealth Administrator Account Creation

To guarantee unrestricted access regardless of whether the web shell file is detected, the payload injects a rogue administrative user directly into the database:

• User Identification: The account is registered in the wp_users table with a username formatted as wp_ followed by randomized hexadecimal strings (such as wp_a1b2c3d4).
• Dashboard Evasion: The attacker leverages WordPress user-filtering hooks to hide the malicious account from the standard WordPress User Management dashboard (/wp-admin/users.php), preventing casual discovery by administrators.

Multi-Layered Persistence Mechanisms

The intrusion deploys secondary persistence channels to ensure survivability:

• Must-Use (MU) Plugins: Drops custom PHP scripts into /wp-content/mu-plugins/ named wp-<hex>.php. Must-Use plugins execute automatically before any standard plugins or theme files load and cannot be disabled via the WordPress UI.
• Scheduled WP-Cron Task: Registers an automated background cron hook named _wp_cconsent_tick, periodically invoking the web shell and re-verifying that persistence hooks remain intact.

Attack Vector & Impact

The supply chain compromise bypassed conventional perimeter defenses by subverting trusted developer infrastructure:

• Root Server Compromise (T1195.002): The threat actor compromised the developer's server at adminmenueditor.com. When the developer initially discovered the intrusion on September 14 and issued clean version 2.36, the adversary maintained active root-level persistence, promptly re-infecting version 2.36 downloads and attempting to scrub server access logs before the developer disconnected the physical host.
• Mass Downstream Infection: Telemetry confirms approximately 230 customer accounts were directly impacted, resulting in confirmed infections across at least 1,500 production WordPress websites.
• Full Server Takeover (T1505.003, T1136.001): The combination of an unauthenticated web shell and a hidden administrator account grants the adversary total control over affected web servers. Attackers can exfiltrate customer databases, alter e-commerce payment gateways (web skimming / Magecart), install SEO spam redirects, and pivot into the underlying server operating system.

Detection & Mitigation

Because the malicious payload grants complete root-level control over WordPress installations, administrators must assume total site compromise:

Immediate Remediation Steps

• Restore from Clean Backups: Highly recommended: completely restore affected websites from a known clean backup created prior to September 14, 2026.
• Delete Compromised Plugin Releases: If backups are unavailable, immediately delete Admin Menu Editor Pro versions 2.35 and 2.36. Reinstall clean version 2.34 or wait for verified version 2.37+ from uncompromised infrastructure.
• Remove Malicious File Artifacts: Delete the entire directory /wp-content/object-cache/ (ensure legitimate object-cache.php is preserved if using Redis/Memcached plugins). Audit and delete any randomized PHP files inside /wp-content/mu-plugins/.
• Database Sanitization: Query the wp_users table directly via phpMyAdmin or WP-CLI to identify and delete rogue accounts starting with wp_. Delete all options starting with wp_ocache and _wp_ocache_ from wp_options.
• Cron Cleanup: Check the cron array in wp_options or use WP-CLI (wp cron event list) to delete the _wp_cconsent_tick hook.

Credential Rotation & Hardening

• Regenerate Salts: Invalidate all active user sessions by generating fresh security keys and salts inside wp-config.php.
• Credential Reset: Force an immediate password reset for all legitimate WordPress users and rotate database credentials, SFTP/SSH keys, hosting control panel passwords, and external API tokens.
• File Integrity Auditing: Run a comprehensive malware scan (e.g. Wordfence, Sucuri, or Maldet) to identify secondary backdoors or modified core files.