Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites Affected

Admin Menu Editor Pro WordPress Plugin Backdoored via (TL-2026-2524) is a critical-severity supply-chain compromise, first published 2026-09-15. It has no confirmed attribution, affects Janis Elsts (Admin Menu Editor Pro / adminmenueditor.com) Admin Menu, maps to 10 MITRE ATT&CK techniques (T1036.005, T1078, T1136), and is covered by 9 detection rules and 10 indicators of compromise.

Key facts for TL-2026-2524

Threat ID
TL-2026-2524
Severity
CRITICAL
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-09-15
Last reviewed
2026-09-15
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
10

Malware and tooling in Admin Menu Editor Pro WordPress Plugin Backdoored via

Malware and tooling: wp-user-consent.php web shell

Attackers with apparent root-level access to the adminmenueditor.com maintainer infrastructure trojanized the premium Admin Menu Editor Pro WordPress plugin, injecting a web shell (includes/wp-user-consent.php) that creates a hidden admin user and a persistence directory (wp-content/object-cache/). Malicious version 2.35 was distributed for roughly seven hours on September 14, 2026; a subsequent 'clean' 2.36 build was also found compromised before the developer took the site offline to restore it. Roughly 1,500 sites across at least 230 customers are confirmed affected.

How Admin Menu Editor Pro WordPress Plugin Backdoored via works

On September 14, 2026, attackers who had obtained apparent root-level access to the maintainer infrastructure behind adminmenueditor.com trojanized Admin Menu Editor Pro, a premium WordPress plugin developed by Janis Elsts with a separately-distributed free counterpart on wordpress.org used by 300,000+ sites. The compromised release, version 2.35, was distributed directly from the vendor's own site -- the Pro edition is sold and updated outside the wordpress.org repository -- for roughly seven hours, from approximately 06:00 UTC to 13:00 UTC.

The trojanized package added a new file, includes/wp-user-consent.php, functioning as a PHP web shell disguised under a GDPR/consent-sounding filename intended to blend in with legitimate plugin code that an administrator reviewing the plugin's files would not think to inspect. On activation the malicious code created a hidden WordPress administrator account, with observed usernames following a wp_*-prefixed pattern in the wp_users table, and wrote backdoor configuration/state into the wp_options table under option names prefixed wp_ocache*. It also established a persistence directory at wp-content/object-cache/, a path chosen to masquerade as WordPress's standard object-cache drop-in location so that file-integrity checks or malware scans tuned to ignore core caching infrastructure would pass over it.

After version 2.35 was pulled at 13:00 UTC, the vendor pushed what was believed to be a clean version 2.36 at 19:00 UTC the same day -- but the attacker had retained access to the distribution infrastructure and had re-compromised that build as well before release, meaning customers who updated during the second window received a second trojanized package. Janis Elsts subsequently took adminmenueditor.com offline entirely to rebuild and restore the infrastructure rather than risk shipping a third compromised release.

As of disclosure, at least 1,500 individual WordPress sites across roughly 230 confirmed Pro customers are known to have received one of the two malicious builds, and several hundred additional customers who downloaded the plugin during the compromise window are considered potentially at risk pending further investigation. Version 2.34, the release immediately prior to 2.35, is believed clean, and the free wordpress.org-distributed Admin Menu Editor plugin was not affected, since it uses a distribution channel unrelated to the compromised adminmenueditor.com infrastructure.

This incident fits a broader pattern of 2026 WordPress premium-plugin supply-chain compromises that target vendor-side distribution infrastructure rather than the wordpress.org repository directly. Comparable incidents earlier in the year include the ShapedPlugin build-pipeline compromise (June 2026, a credential-stealing second-stage backdoor delivered via a fake WooCommerce plugin), the BdThemes JSON-feed poisoning attack (August 2026, rogue admin creation plus web shells pushed across seven Elementor add-ons), and the EssentialPlugin ownership-transfer backdoor (planted after a marketplace acquisition, activated April 2026 across 20+ plugins via a disguised 'compatibility update'). No attribution to a specific threat actor or group has been established for the Admin Menu Editor Pro compromise, and no CVE has been assigned, since the underlying issue is a compromise of vendor infrastructure and distribution trust rather than a flaw in the plugin's own code.

MITRE ATT&CK techniques used in TL-2026-2524

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories

Persistence

T1078 Valid Accounts; T1136 Create Account; T1505.003 Web Shell; T1554 Compromise Host Software Binary

Initial Access

T1195.002 Compromise Software Supply Chain

Resource Development

T1584.004 Server; T1587.001 Malware; T1608.001 Upload Malware

Affected products and versions in Admin Menu Editor Pro WordPress Plugin Backdoored via

  • Janis Elsts (Admin Menu Editor Pro / adminmenueditor.com) — Admin Menu Editor Pro (premium WordPress plugin)
    Vulnerable versions: 2.35; 2.36

Remediation for Admin Menu Editor Pro WordPress Plugin Backdoored via

Patches

  • No verified clean patched release was available at time of publication; the vendor took adminmenueditor.com offline to rebuild distribution infrastructure after discovering the replacement 2.36 build was also compromised

Immediate actions

  • Audit the wp_users table for administrator accounts with usernames matching a wp_*-prefixed pattern that were not intentionally created, and disable/delete any unrecognized admin accounts immediately
  • Search the wp_options table for entries prefixed wp_ocache* and remove any that do not correspond to a legitimate, verified caching plugin already in use on the site
  • Check the Admin Menu Editor Pro plugin directory for includes/wp-user-consent.php and delete it; inspect wp-content/object-cache/ for unauthorized files and remove the directory if it was not created by a legitimate object-cache drop-in
  • Roll back to Admin Menu Editor Pro version 2.34 (believed clean) or fully deactivate and remove the plugin until the vendor publishes and confirms a verified clean release
  • Force-reset all WordPress administrator passwords, application passwords, and any API keys/secrets on any site that ran version 2.35 or 2.36 between 2026-09-14 06:00 UTC and the time of remediation

Workarounds

  • Restore affected sites from a known-good backup predating 2026-09-14 06:00 UTC
  • Manually remove the plugin along with the includes/wp-user-consent.php web shell and the wp-content/object-cache/ persistence directory, and reinstall Admin Menu Editor Pro only once the vendor confirms a clean build is available

Longer-term hardening

  • Do not resume automatic updates for Admin Menu Editor Pro until the vendor publishes a verified-clean release and confirms restoration of adminmenueditor.com infrastructure integrity
  • Deploy file-integrity monitoring on wp-content/ and wp-includes/ that flags newly-created PHP files and unexpected additions inside third-party plugin directories, including files masquerading as caching components
  • Establish a policy of validating premium/paid WordPress plugin updates -- which bypass the wordpress.org review and scanning process -- against vendor-published checksums or signatures before deployment
  • Periodically audit the wp_users and wp_usermeta tables across all managed WordPress sites for unauthorized administrator-role accounts

Weaknesses (CWE) in Admin Menu Editor Pro WordPress Plugin Backdoored via

CWE-506, CWE-912

Timeline of Admin Menu Editor Pro WordPress Plugin Backdoored via

  • Elsts publishes a static incident page on adminmenueditor.com detailing the compromise scope and remediation guidance after taking the site offline, stating several hundred additional customers who downloaded during the window could also be affected.
  • Elsts analyzes update-server distribution logs and determines that approximately 230 customers received a malicious version, corroborating the estimate of at least 1,500 affected sites (often multiple sites per customer).
  • Developer Janis Elsts takes adminmenueditor.com offline entirely to rebuild and restore the maintainer infrastructure after discovering the replacement 2.36 build was also compromised.
  • A supposedly clean version 2.36 is pushed at approximately 19:00 UTC, but the attacker has retained access to the distribution infrastructure and re-compromised this build as well before release.
  • Version 2.35 is pulled from distribution at approximately 13:00 UTC after roughly seven hours of availability.
  • Trojanized Admin Menu Editor Pro version 2.35, containing the includes/wp-user-consent.php web shell, is distributed from adminmenueditor.com starting at approximately 06:00 UTC.
  • BleepingComputer publishes the incident at 4:34 PM, confirming at least 1,500 affected sites across roughly 230 confirmed Pro customers, with several hundred additional customers who downloaded during the compromise window considered potentially at risk.

Sources cited for Admin Menu Editor Pro WordPress Plugin Backdoored via

More in supply chain

Detection coverage for TL-2026-2524

As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2524 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats