# Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites Affected

> Attackers with apparent root-level access to the adminmenueditor.com maintainer infrastructure trojanized the premium Admin Menu Editor Pro WordPress plugin, injecting a web shell (includes/wp-user-consent.php) that creates a hidden admin user and a persistence directory (wp-content/object-cache/). Malicious version 2.35 was distributed for roughly seven hours on September 14, 2026; a subsequent 'clean' 2.36 build was also found compromised before the developer took the site offline to restore it. Roughly 1,500 sites across at least 230 customers are confirmed affected.

- **Published:** 2026-09-15T00:00:00Z
- **Last reviewed:** 2026-09-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2524
- **ID:** TL-2026-2524
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On September 14, 2026, attackers who had obtained apparent root-level access to the maintainer infrastructure behind adminmenueditor.com trojanized Admin Menu Editor Pro, a premium WordPress plugin developed by Janis Elsts with a separately-distributed free counterpart on wordpress.org used by 300,000+ sites. The compromised release, version 2.35, was distributed directly from the vendor's own site -- the Pro edition is sold and updated outside the wordpress.org repository -- for roughly seven hours, from approximately 06:00 UTC to 13:00 UTC.

The trojanized package added a new file, includes/wp-user-consent.php, functioning as a PHP web shell disguised under a GDPR/consent-sounding filename intended to blend in with legitimate plugin code that an administrator reviewing the plugin's files would not think to inspect. On activation the malicious code created a hidden WordPress administrator account, with observed usernames following a wp_*-prefixed pattern in the wp_users table, and wrote backdoor configuration/state into the wp_options table under option names prefixed wp_ocache*. It also established a persistence directory at wp-content/object-cache/, a path chosen to masquerade as WordPress's standard object-cache drop-in location so that file-integrity checks or malware scans tuned to ignore core caching infrastructure would pass over it.

After version 2.35 was pulled at 13:00 UTC, the vendor pushed what was believed to be a clean version 2.36 at 19:00 UTC the same day -- but the attacker had retained access to the distribution infrastructure and had re-compromised that build as well before release, meaning customers who updated during the second window received a second trojanized package. Janis Elsts subsequently took adminmenueditor.com offline entirely to rebuild and restore the infrastructure rather than risk shipping a third compromised release.

As of disclosure, at least 1,500 individual WordPress sites across roughly 230 confirmed Pro customers are known to have received one of the two malicious builds, and several hundred additional customers who downloaded the plugin during the compromise window are considered potentially at risk pending further investigation. Version 2.34, the release immediately prior to 2.35, is believed clean, and the free wordpress.org-distributed Admin Menu Editor plugin was not affected, since it uses a distribution channel unrelated to the compromised adminmenueditor.com infrastructure.

This incident fits a broader pattern of 2026 WordPress premium-plugin supply-chain compromises that target vendor-side distribution infrastructure rather than the wordpress.org repository directly. Comparable incidents earlier in the year include the ShapedPlugin build-pipeline compromise (June 2026, a credential-stealing second-stage backdoor delivered via a fake WooCommerce plugin), the BdThemes JSON-feed poisoning attack (August 2026, rogue admin creation plus web shells pushed across seven Elementor add-ons), and the EssentialPlugin ownership-transfer backdoor (planted after a marketplace acquisition, activated April 2026 across 20+ plugins via a disguised 'compatibility update'). No attribution to a specific threat actor or group has been established for the Admin Menu Editor Pro compromise, and no CVE has been assigned, since the underlying issue is a compromise of vendor infrastructure and distribution trust rather than a flaw in the plugin's own code.

## MITRE ATT&CK

- T1584.004 Server
- T1587.001 Malware
- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1505.003 Web Shell
- T1136 Create Account
- T1078 Valid Accounts
- T1554 Compromise Host Software Binary
- T1564.001 Hidden Files and Directories
- T1036.005 Match Legitimate Resource Name or Location

## Sources

- [Malicious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites](https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/)
- [Admin Menu Editor – WordPress plugin](https://wordpress.org/plugins/admin-menu-editor/)
- [Admin Menu Editor Pro WordPress Plugin Security Vulnerabilities](https://wpscan.com/plugin/admin-menu-editor-pro/)
- [ShapedPlugin update flow hacked to infect WordPress sites](https://www.bleepingcomputer.com/news/security/shapedplugin-update-flow-hacked-to-infect-wordpress-sites/)
- [BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins](https://thehackernews.com/2026/08/bdthemes-supply-chain-attack-poisons.html)
- [Critical Supply Chain Compromise on 20+ Plugins by EssentialPlugin](https://patchstack.com/articles/critical-supply-chain-compromise-on-20-plugins-by-essentialplugin/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2524