Admin Menu Editor Pro backdoor: check your WordPress now

If you run Admin Menu Editor Pro on a WordPress site, stop reading and go check wp-content/plugins/ for a file named includes/wp-user-consent.php. On September 14 an attacker got into the server hosting adminmenueditor.com and shipped backdoored plugin updates through the vendor's own update channel. Roughly 230 customers are confirmed hit, across at least 1,500 sites. Your site did not get exploited. Your site got updated.

What actually happened

The developer, Janis Elsts, published an incident report and pulled the site offline while rebuilding. BleepingComputer's account lays out the timeline:

• Version 2.35 was served as a malicious update from roughly 06:00 to 13:00 UTC on September 14
• A clean 2.36 went out around 19:00 UTC — and was compromised in turn
• 2.34 is the last known-good version. The free version of the plugin is unaffected
• Confirmed: ~230 customers, 1,500+ sites. Several hundred more may have pulled a bad build inside the window

The payload dropped includes/wp-user-consent.php — a web shell — and created a hidden administrator account prefixed wp_ that does not render in the WordPress users list.

Why this matters for your business

The plugin was not vulnerable. The vendor was. Nobody scanned your site, guessed a password or found a CVE. A paid, well-maintained, actively-supported plugin updated itself, exactly as designed, and the update was hostile. Auto-update — the thing every security guide tells you to turn on — is the delivery mechanism here. That is uncomfortable and it is still the right default; a compromised update channel is rarer than an unpatched one.

What to check, in order. On every site running the Pro version:

1. Look for wp-content/plugins/admin-menu-editor-pro/includes/wp-user-consent.php and the directory /wp-content/object-cache/
2. Query the wp_users table directly — not the dashboard — for accounts beginning wp_
3. Search wp_options for keys matching wp_ocache*
4. Check installed plugin version. 2.35 or 2.36 means assume compromise

Found anything? Restore from a backup taken before September 14, or remove the plugin and the database entries by hand. Then rotate every admin password, every API key stored in the site, and the payment gateway credentials. A web shell running as your web user read everything the site could read.

The lesson is staging, not paranoia. Most small-business sites update plugins straight to production because there is no second environment. A staging site that takes updates 48 hours ahead of production would have caught this — the malicious build was live for seven hours and pulled the same day. That delay costs you nothing on a normal Tuesday.

Sources: Admin Menu Editor security incident report, BleepingComputer.