WordPress admins urged to check for a malicious Admin Menu Editor Pro update

When a WordPress site receives an automatic update, most owners assume the code comes from a trusted source. In mid‑September 2026 that assumption was broken for the Admin Menu Editor Pro plugin, a tool used by hundreds of businesses to customise their admin menus. An unauthorised actor uploaded a compromised version of the plugin, creating hidden accounts and a web shell that could hand over full control of the affected sites.

How the supply‑chain attack unfolded

The maintainer’s website, adminmenueditor.com, was breached on 14 September 2026. The attacker used that access to publish version 2.35 of the Pro plugin as an official update. The malicious package was live for roughly seven hours, from about 06:00 UTC to 13:00 UTC, before the developer removed it.

Technical analysis shows the update contained an includes/wp-user-consent.php file that dropped a web shell onto the target site. The same code also inserted a hidden user entry whose username began with wp_ into the wp_users table, effectively giving the attacker a stealthy backdoor.

Who was hit and how many sites are at risk?

Server logs indicate that at least 230 paying customers installed the tainted version, affecting an estimated 1 500 WordPress installations. The developer warned that several hundred additional customers downloaded the plugin in or near the same time window and could also be compromised. The exact number of affected sites beyond the initial 230 remains uncertain, as does the scale of any undetected infections.

Why the attacker could stay in control

Evidence suggests the intruder obtained root‑level access to the maintainer’s hosting environment. That level of privilege allowed the hacker to re‑inject malicious code even after a clean version 2.36 was released later that day at 19:00 UTC. In other words, the clean release did not automatically remove the backdoor from sites that had already installed the compromised update.

What is still safe?

Version 2.34 of the Pro plugin is believed to be clean, and the free‑of‑charge Admin Menu Editor plugin shows no signs of compromise. However, any site that upgraded to version 2.35, or that downloaded the update during the window, should be treated as potentially breached.

Photo by olia danilevich on Pexels

Immediate actions for site owners

The safest path is to restore the site from a backup taken before 14 September 2026. If a clean backup is unavailable, follow the steps below to remove the malicious artefacts manually. These actions are drawn from the developer’s own recommendations and from standard WordPress hardening practice.

• Delete the plugin, Remove the admin-menu-editor-pro directory from wp‑content/plugins.
• Remove the object‑cache folder, Delete the entire /wp-content/object-cache/ directory that the malicious code created.
• Purge related database entries, Look for options and user records that start with wp_ and were added after the update window. The wp_options table may contain entries with names like admin_menu_editor_pro_*; the wp_users table may have a hidden account with a wp_ prefix.
• Run a full malware scan, Use a reputable scanner to verify that no additional backdoors remain.
• Change all admin passwords, After cleaning, rotate credentials for any accounts with administrative privileges.
• Monitor logs for suspicious activity, Keep an eye on login attempts and file changes for at least two weeks after remediation.

If you choose the backup route, ensure the snapshot predates the 14 September breach and that it was taken on a system you trust. Restoring a compromised backup can re‑introduce the backdoor.

Longer‑term hardening tips

Even after you have removed the immediate threat, consider these measures to reduce the risk of future supply‑chain attacks:

• Enable two‑factor authentication for all admin users.
• Limit plugin auto‑updates to a staging environment where you can test new versions before they go live.
• Audit third‑party plugins regularly for signs of unexpected files or code changes.
• Keep server software up to date and restrict root‑level access to a minimal set of trusted administrators.

Photo by Daniil Komov on Pexels

Bottom line

The Admin Menu Editor Pro incident demonstrates how a brief window of malicious code on an official plugin site can expose thousands of WordPress sites to remote control. Site owners should verify whether they installed version 2.35, restore from a clean backup if possible, and follow the manual cleanup steps if not. Ongoing vigilance, especially around third‑party plugins, remains the best defence against similar supply‑chain compromises.

Terms used in this article

• Plugin, A piece of software that adds specific features to a WordPress site.
• Web shell, A script that gives an attacker command‑line access to a web server through a browser.
• Root‑level access, Full administrative control over a server’s operating system.
• Object‑cache directory, A folder used by WordPress to store cached data that speeds up page loads.
• Backup, A copy of a site’s files and database taken at a specific point in time.