Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites Affected

Key facts for Admin Menu Editor Pro backdoor

Detection coverage for Admin Menu Editor Pro backdoor

As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2524 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Rogue wp_-Prefixed Administrator Account and wp_ocache* Backdoor Options Created (SPL)

Detects creation of a hidden WordPress administrator account with a wp_-prefixed username, backdoor configuration written into wp_options under wp_ocache*-prefixed keys, and creation of the wp-content/object-cache/ persistence directory — the three persistence mechanisms established by the Admin Menu Editor Pro web shell after activation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1136, T1078, T1554, T1564.001, T1036.005
• Data sources: mysql_audit_log, wordpress_audit_log, file_integrity_monitoring, osquery_file_events
• Severity: critical
• Confidence: high

Splunk SPL

index=wordpress sourcetype="mysql:audit" command="INSERT" table="wp_users" username="wp_*"
| eval indicator="rogue_admin_account_created"
| append
    [ search index=wordpress sourcetype="mysql:audit" command="INSERT" table="wp_options" option_name="wp_ocache*"
      | eval indicator="backdoor_option_written" ]
| append
    [ search index=osquery sourcetype="osquery:results" name="file_events" action="created" target_path="*wp-content/object-cache*"
      | eval indicator="persistence_directory_created" ]
| table _time, host, indicator, username, table, option_name, target_path
| sort - _time

Microsoft KQL

WordPressAuditLog_CL
| where EventType_s == "user_created" and UserLogin_s startswith "wp_" and UserRole_s == "administrator"
| project TimeGenerated, SiteHost_s, UserLogin_s, Indicator = "rogue_admin_account_created"
| union (
    WordPressAuditLog_CL
    | where EventType_s == "option_updated" and OptionName_s startswith "wp_ocache"
    | project TimeGenerated, SiteHost_s, UserLogin_s = OptionName_s, Indicator = "backdoor_option_written"
)
| union (
    Syslog
    | where SyslogMessage has "wp-content/object-cache" and SyslogMessage has "created"
    | project TimeGenerated, SiteHost_s = HostName, UserLogin_s = "", Indicator = "persistence_directory_created"
)
| sort by TimeGenerated desc

Sigma

title: WordPress Rogue Administrator Account and wp_ocache Backdoor Option Creation
id: 4b6e2d91-8a3c-4f7b-9d2e-1a8c5f6b3e22
status: experimental
description: Detects creation of a hidden wp_-prefixed administrator account or wp_ocache*-prefixed backdoor options in wp_options, the persistence mechanisms planted by the trojanized Admin Menu Editor Pro plugin (v2.35/2.36).
references:
    - https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-15
tags:
    - attack.persistence
    - attack.t1136
    - attack.t1078
    - attack.t1554
    - attack.defense-evasion
    - attack.t1564.001
    - attack.t1036.005
logsource:
    product: wordpress
    service: audit_log
detection:
    selection_account:
        EventType: 'user_created'
        UserLogin|startswith: 'wp_'
        UserRole: 'administrator'
    selection_option:
        EventType: 'option_updated'
        OptionName|startswith: 'wp_ocache'
    condition: 1 of selection_*
falsepositives:
    - A legitimate caching plugin that independently writes wp_ocache-prefixed options or a wp-content/object-cache drop-in — verify against the site's confirmed plugin inventory
    - Administrator accounts created by an internal provisioning tool that happens to use a wp_ username prefix
level: critical

Known false positives:

• A legitimate caching plugin that also creates a wp-content/object-cache directory or writes wp_ocache-prefixed options — verify against the site's installed plugin inventory before treating as malicious
• Automated provisioning tooling that creates administrator accounts with a wp_ prefix as part of legitimate internal deployment conventions

Tuning notes: Cross-reference any wp_-prefixed administrator account or wp_ocache* option against the list of intentionally installed caching plugins on that site; treat as high-confidence positive when Admin Menu Editor Pro 2.35/2.36 was also installed on the same host per TL-2026-2524-SPL-001.

• 🔒 Admin Menu Editor Pro Trojanized Package Delivery — [indicator] Web Shell Drop (KQL) · unlock with TL Creds
• 🔒 Rogue wp_-Prefixed Administrator Account and wp_ocache* Backdoor Options Created (KQL) · unlock with TL Creds
• 🔒 HTTP Callback to [indicator] Web Shell and Login from Hidden wp_ Administrator (KQL) · unlock with TL Creds
• 🔒 Admin Menu Editor Pro Trojanized Package Delivery — [indicator] Web Shell Drop (Sigma) · unlock with TL Creds
• 🔒 Rogue wp_-Prefixed Administrator Account and wp_ocache* Backdoor Options Created (Sigma) · unlock with TL Creds
• 🔒 HTTP Callback to [indicator] Web Shell and Login from Hidden wp_ Administrator (Sigma) · unlock with TL Creds
• 🔒 Admin Menu Editor Pro Trojanized Package Delivery — [indicator] Web Shell Drop (SPL) · unlock with TL Creds
• 🔒 HTTP Callback to [indicator] Web Shell and Login from Hidden wp_ Administrator (SPL) · unlock with TL Creds

Indicators of compromise for Admin Menu Editor Pro backdoor

As of 2026-09-15, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-2524.

How Admin Menu Editor Pro backdoor works

Roughly 1,500 sites across at least 230 customers are confirmed affected.

On September 14, 2026, attackers who had obtained apparent root-level access to the maintainer infrastructure behind adminmenueditor.com trojanized Admin Menu Editor Pro, a premium WordPress plugin developed by Janis Elsts with a separately-distributed free counterpart on wordpress.org used by 300,000+ sites. The compromised release, version 2.35, was distributed directly from the vendor's own site -- the Pro edition is sold and updated outside the wordpress.org repository -- for roughly seven hours, from approximately 06:00 UTC to 13:00 UTC.

The trojanized package added a new file, includes/wp-user-consent.php, functioning as a PHP web shell disguised under a GDPR/consent-sounding filename intended to blend in with legitimate plugin code that an administrator reviewing the plugin's files would not think to inspect. On activation the malicious code created a hidden WordPress administrator account, with observed usernames following a wp_*-prefixed pattern in the wp_users table, and wrote backdoor configuration/state into the wp_options table under option names prefixed wp_ocache*. It also established a persistence directory at wp-content/object-cache/, a path chosen to masquerade as WordPress's standard object-cache drop-in location so that file-integrity checks or malware scans tuned to ignore core caching infrastructure would pass over it.

After version 2.35 was pulled at 13:00 UTC, the vendor pushed what was believed to be a clean version 2.36 at 19:00 UTC the same day -- but the attacker had retained access to the distribution infrastructure and had re-compromised that build as well before release, meaning customers who updated during the second window received a second trojanized package. Janis Elsts subsequently took adminmenueditor.com offline entirely to rebuild and restore the infrastructure rather than risk shipping a third compromised release.

As of disclosure, at least 1,500 individual WordPress sites across roughly 230 confirmed Pro customers are known to have received one of the two malicious builds, and several hundred additional customers who downloaded the plugin during the compromise window are considered potentially at risk pending further investigation. Version 2.34, the release immediately prior to 2.35, is believed clean, and the free wordpress.org-distributed Admin Menu Editor plugin was not affected, since it uses a distribution channel unrelated to the compromised adminmenueditor.com infrastructure.

This incident fits a broader pattern of 2026 WordPress premium-plugin supply-chain compromises that target vendor-side distribution infrastructure rather than the wordpress.org repository directly. Comparable incidents earlier in the year include the ShapedPlugin build-pipeline compromise (June 2026, a credential-stealing second-stage backdoor delivered via a fake WooCommerce plugin), the BdThemes JSON-feed poisoning attack (August 2026, rogue admin creation plus web shells pushed across seven Elementor add-ons), and the EssentialPlugin ownership-transfer backdoor (planted after a marketplace acquisition, activated April 2026 across 20+ plugins via a disguised 'compatibility update'). No attribution to a specific threat actor or group has been established for the Admin Menu Editor Pro compromise, and no CVE has been assigned, since the underlying issue is a compromise of vendor infrastructure and distribution trust rather than a flaw in the plugin's own code.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories

Persistence

T1078 Valid Accounts; T1136 Create Account; T1505.003 Web Shell; T1554 Compromise Host Software Binary

Initial Access

T1195.002 Compromise Software Supply Chain

Resource Development

T1584.004 Server; T1587.001 Malware; T1608.001 Upload Malware

Remediation for Admin Menu Editor Pro backdoor

Patches

• No verified clean patched release was available at time of publication; the vendor took adminmenueditor.com offline to rebuild distribution infrastructure after discovering the replacement 2.36 build was also compromised

Immediate actions

• Audit the wp_users table for administrator accounts with usernames matching a wp_*-prefixed pattern that were not intentionally created, and disable/delete any unrecognized admin accounts immediately
• Search the wp_options table for entries prefixed wp_ocache* and remove any that do not correspond to a legitimate, verified caching plugin already in use on the site
• Check the Admin Menu Editor Pro plugin directory for includes/wp-user-consent.php and delete it; inspect wp-content/object-cache/ for unauthorized files and remove the directory if it was not created by a legitimate object-cache drop-in
• Roll back to Admin Menu Editor Pro version 2.34 (believed clean) or fully deactivate and remove the plugin until the vendor publishes and confirms a verified clean release
• Force-reset all WordPress administrator passwords, application passwords, and any API keys/secrets on any site that ran version 2.35 or 2.36 between 2026-09-14 06:00 UTC and the time of remediation

Workarounds

• Restore affected sites from a known-good backup predating 2026-09-14 06:00 UTC
• Manually remove the plugin along with the includes/wp-user-consent.php web shell and the wp-content/object-cache/ persistence directory, and reinstall Admin Menu Editor Pro only once the vendor confirms a clean build is available

Longer-term hardening

• Do not resume automatic updates for Admin Menu Editor Pro until the vendor publishes a verified-clean release and confirms restoration of adminmenueditor.com infrastructure integrity
• Deploy file-integrity monitoring on wp-content/ and wp-includes/ that flags newly-created PHP files and unexpected additions inside third-party plugin directories, including files masquerading as caching components
• Establish a policy of validating premium/paid WordPress plugin updates -- which bypass the wordpress.org review and scanning process -- against vendor-published checksums or signatures before deployment
• Periodically audit the wp_users and wp_usermeta tables across all managed WordPress sites for unauthorized administrator-role accounts

Affected and fixed versions

• Janis Elsts (Admin Menu Editor Pro / adminmenueditor.com) — Admin Menu Editor Pro (premium WordPress plugin)
  Vulnerable versions: 2.35; 2.36

Timeline of Admin Menu Editor Pro backdoor

• 2026-09-14 Elsts publishes a static incident page on locked-ioc-9 detailing the compromise scope and remediation guidance after taking the site offline, stating several hundred additional customers who downloaded during the window could also be affected.
• 2026-09-14 Elsts analyzes update-server distribution logs and determines that approximately 230 customers received a malicious version, corroborating the estimate of at least 1,500 affected sites (often multiple sites per customer).
• 2026-09-14 Developer locked-ioc-10 takes locked-ioc-9 offline entirely to rebuild and restore the maintainer infrastructure after discovering the replacement 2.36 build was also compromised.
• 2026-09-14 A supposedly clean version 2.36 is pushed at approximately 19:00 UTC, but the attacker has retained access to the distribution infrastructure and re-compromised this build as well before release.
• 2026-09-14 Version 2.35 is pulled from distribution at approximately 13:00 UTC after roughly seven hours of availability.
• 2026-09-14 Trojanized Admin Menu Editor Pro version 2.35, containing the includes/locked-ioc-3, is distributed from locked-ioc-9 starting at approximately 06:00 UTC.
• 2026-09-15 BleepingComputer publishes the incident at 4:34 PM, confirming at least 1,500 affected sites across roughly 230 confirmed Pro customers, with several hundred additional customers who downloaded during the compromise window considered potentially at risk.

Sources cited for Admin Menu Editor Pro backdoor

• Admin Menu Editor Pro WordPress Plugin Security Vulnerabilities wpscan.com · Advisory · 2026-09-15
• Admin Menu Editor – WordPress plugin wordpress.org · Vendor report · 2026-09-15
• Critical Supply Chain Compromise on 20+ Plugins by EssentialPlugin patchstack.com · Research · 2026-04-15
• Malicious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites BleepingComputer · News · 2026-09-15
• ShapedPlugin update flow hacked to infect WordPress sites BleepingComputer · News · 2026-06-18
• BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins The Hacker News · News · 2026-08-11

More in supply chain

• Software Supply Chain Attacks Overview: CCleaner, Codecov, SolarWinds Orion, npm Shai-Hulud, Kaseya VSA, MOVEit Transfer
• BO Team (Black Owl) Supply Chain Attack Against a Software Developer's Infrastructure (CVE-2021-44228)
• Backdoored ARTEX Docker Hub images (tomicdd/artex and clones) expose 62 consoles to unauthenticated root shell; CERT-In CIAD-2026-0058 flags AI-assisted actor Crafty Falcon
• PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)
• NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware

Previous and next in supply chain

• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor Previous report
• PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Hunting Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages