Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

A threat actor compromised the maintainer's website for the Admin Menu Editor Pro WordPress plugin and distributed malicious updates (versions 2.35 and 2.36), which backdoored approximately 1,500 sites. The backdoor created a hidden user account and installed a web shell via a malicious file named wp-user-consent.php. The attacker had likely gained root-level access to the server, prompting the developer to take the site offline and issue cleanup guidance. Customers are advised to check for specific indicators of compromise and restore from clean backups.

AI-extracted · verify before operational use