Admin Menu Editor Pro plugin compromise affects 1,500 WordPress sites

A security breach involving the Admin Menu Editor Pro WordPress plugin has compromised approximately 1,500 websites. A threat actor gained unauthorized access to the developer’s website and distributed a malicious version 2.35 update.

The compromised update contained a file that installed a web shell and created hidden user accounts. Developer Janis Elsts reported that the initial attack occurred on September 14, 2026, between 06:00 and 13:00 UTC. While a clean version 2.36 was released shortly after, the attacker maintained access to the developer's site and compromised the subsequent version as well.

Users are advised to check for suspicious directories such as ‘/wp-content/object-cache’, unusual entries in the wp_options table, or hidden users in the wp_users table. Affected users are encouraged to restore sites from backups made prior to the incident or immediately delete version 2.35.