Summary
- Malicious Admin Menu Editor Pro builds were distributed through the developer’s legitimate infrastructure on 14 September.
- Around 230 customers received compromised software, affecting an estimated 1,500 or more WordPress installations.
- A replacement build was also compromised after the first response, showing that attacker access had not yet been contained.
Attackers compromised the distribution infrastructure for Admin Menu Editor Pro and used its legitimate update channel to deliver backdoored plugin versions to around 230 customers, affecting at least 1,500 WordPress sites.
Developer Jānis Elsts said an unauthorised party accessed the adminmenueditor.com environment on 14 September and uploaded a malicious version 2.35 of the premium plugin.
The compromised build contained a PHP web shell and could create a hidden administrator account on affected WordPress sites. Version 2.35 was distributed for several hours before being removed.
A replacement version, 2.36, was then released, but the attacker still had access to the distribution environment and compromised that build as well. The developer subsequently took the site offline while the infrastructure was rebuilt.
That sequence makes the incident materially different from a conventional plugin vulnerability. Customers did not need to obtain software from an unofficial repository or attacker-controlled domain. Malicious code arrived through the vendor’s own trusted distribution mechanism as an apparent legitimate update.
The premium edition is distributed separately from the free Admin Menu Editor plugin available through WordPress.org. The available evidence indicates that the free edition was not affected.
Analysis of update-server logs indicates that roughly 230 customers received a malicious build. Because customers can manage multiple WordPress installations, the developer estimates that at least 1,500 sites were affected.
The compromised packages established persistence that could survive removal of the original update. Indicators reported in connection with the incident include the malicious PHP file, hidden WordPress users, and additional files associated with the backdoor.
The incident exposes the concentration of trust created by software-update infrastructure. Update systems are supposed to move customers rapidly onto safer software, but the same mechanism can become a high-scale delivery path when a supplier’s build, hosting, or distribution environment is compromised.
The second compromised release is particularly instructive. Replacing a malicious package is not enough if the attacker still controls the system used to publish it.
Incident containment in a software supplier therefore has to extend to credentials, administrative accounts, servers, build processes, update infrastructure, and any other route capable of reintroducing malicious code.
Commercial plugins can also create visibility problems for organisations operating large WordPress estates. Premium extensions may be distributed outside the public WordPress repository and may use their own update mechanisms, making central inventory and integrity monitoring more difficult.
No public attribution has been established for the intrusion, and the available evidence does not support linking it to a named criminal group.
For sites that installed versions 2.35 or affected copies of 2.36, the issue is no longer simply whether the plugin should be upgraded. Those installations may already contain persistence created by the malicious package, requiring the incident to be treated as a potential compromise of the site itself.
