The injected code created a hidden user account on affected installations, giving the attacker a persistent foothold for logging in without the site owner's knowledge. This is a classic supply chain pattern: rather than exploiting a vulnerability in the plugin itself, the attacker abused trust in the update mechanism to deliver malicious code directly to customers.

Affected parties and key details:

• Admin Menu Editor Pro versions distributed via the compromised maintainer website are affected
• More than 200 customers received the malicious updates
• Roughly 1,500 WordPress sites were backdoored as a result
• The malicious code creates a hidden administrative user account

Recommended actions if you run this plugin:

• Review installed users for accounts you did not create, particularly any with elevated privileges
• Remove any unauthorized accounts immediately and rotate all administrator credentials
• Check for signs of tampering and treat affected sites as compromised rather than merely outdated
• Reinstall the plugin only from a trusted, verified source once the vendor confirms clean builds

Site owners should also audit logs for unexpected logins and review file integrity where possible, since a hidden account can be used for further persistence or lateral movement.

Source: Unknown

Have you checked your WordPress installs for unexpected admin accounts since this campaign came to light, and how is your organization handling plugin supply chain risk?