Admin Menu Editor Pro updates reportedly backdoor at least 1,500 WordPress sites

Malicious code in updates 2.35 and 2.36

BleepingComputer reported that an unauthorized party accessed adminmenueditor.com and uploaded a malicious Admin Menu Editor Pro 2.35 update. The update allegedly created a hidden WordPress user account and installed a web shell.

Developer Janis Elsts said that a clean 2.36 replacement was later compromised as well. Based on update-server logs, Elsts said about 230 customers installed the initial malicious update on at least 1,500 sites, while additional downloads near the relevant period may also have been affected.

Version 2.34 was believed to be clean, and the free version of Admin Menu Editor did not appear to be affected.

The developer says malicious updates 2.35 and then 2.36 were distributed through the Admin Menu Editor Pro website before the site was taken offline.

A maintenance update channel reportedly delivered concealed access to customer sites. The figure of at least 1,500 sites comes from the developer’s initial log analysis; additional downloads could put the total higher.