Affected Systems
Admin Menu Editor Pro WordPress plugin versions 2.35 and 2.36. At least 230 customers affected across approximately 1,500 WordPress sites. The free version (300,000+ installations) is not affected. Attack occurred September 14, 2026 between 06:00-13:00 UTC and continued after initial remediation.
Exploitation Status
Active exploitation confirmed. Threat actor compromised the plugin maintainer's website (adminmenueditor.com) with root-level server access and distributed malicious updates that installed web shells and created hidden administrative accounts on victim WordPress sites.
Business Impact
Attackers gained persistent backdoor access to approximately 1,500 WordPress sites through hidden admin accounts and web shells. The compromise grants full site control, enabling data theft, malware distribution, SEO spam, or further lateral movement. Organizations using affected versions face immediate breach risk. The maintainer's website remains offline pending full remediation, disrupting legitimate update distribution.
Urgency
🔴 Immediate
Recommended Actions
- Immediately check Admin Menu Editor Pro installations for versions 2.35 or 2.36 and verify presence of includes/wp-user-consent.php file or /wp-content/object-cache/ directory
- Query wp_users table for accounts beginning with 'wp_' and wp_options table for entries named 'wp_ocache*' that indicate compromise
- Restore affected WordPress sites from known-clean backups dated before September 14, 2026, or manually delete the plugin, remove /wp-content/object-cache/ directory, and purge malicious database entries
- Conduct full security audit of restored sites including file integrity checks, review of all user accounts, and examination of web server access logs for suspicious activity since September 14
- Monitor adminmenueditor.com for official clean version release and apply updates only after vendor confirmation of infrastructure security