Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
Compromised Admin Menu Editor Pro update server distributed backdoored plugin versions installing web shells and hidden admin accounts on roughly 1,500 WordPress sites.
A threat actor with root-level access to adminmenueditor.com pushed trojanized Admin Menu Editor Pro versions 2.35 and 2.36 containing includes/wp-user-consent.php, which installed a web shell and created a hidden wp_-prefixed user account. At least 230 customers and roughly 1,500 sites installed the malicious update, with several hundred more downloads possibly affected. Developer Janis Elsts took the site offline after the attacker recompromised the clean 2.36 release; version 2.34 and the free plugin are believed unaffected.
- Trojanized versions 2.35 and 2.36 installed web shells via wp-user-consent.php
- About 230 customers and at least 1,500 sites affected
- Attacker had root-level access and compromised the clean 2.36 release too
- Recommended fix is restoring from a pre-September 14 backup
- Compromise indicators include wp_ user, wp_ocache* options, object-cache directory
From the original article
2 min read at bleepingcomputer.com
Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer's website and pushed updates that created a hidden user account. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.