Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
-
A supply chain attack targeting a commercial WordPress plugin has left a large number of sites backdoored. Malicious builds of Admin Menu Editor Pro were distributed to over 200 customers after a threat actor compromised the maintainer's website and pushed updates through the plugin's normal distribution channel. Because the plugin is installed on customer sites, those updates reached far beyond the initial victim count, ultimately backdooring more than 1,500 WordPress sites.
The injected code created a hidden user account on affected installations, giving the attacker a persistent foothold for logging in without the site owner's knowledge. This is a classic supply chain pattern: rather than exploiting a vulnerability in the plugin itself, the attacker abused trust in the update mechanism to deliver malicious code directly to customers.
Affected parties and key details:
- Admin Menu Editor Pro versions distributed via the compromised maintainer website are affected
- More than 200 customers received the malicious updates
- Roughly 1,500 WordPress sites were backdoored as a result
- The malicious code creates a hidden administrative user account
Recommended actions if you run this plugin:
- Review installed users for accounts you did not create, particularly any with elevated privileges
- Remove any unauthorized accounts immediately and rotate all administrator credentials
- Check for signs of tampering and treat affected sites as compromised rather than merely outdated
- Reinstall the plugin only from a trusted, verified source once the vendor confirms clean builds
Site owners should also audit logs for unexpected logins and review file integrity where possible, since a hidden account can be used for further persistence or lateral movement.
Source: Unknown
Have you checked your WordPress installs for unexpected admin accounts since this campaign came to light, and how is your organization handling plugin supply chain risk?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login