Hack of Admin Menu Editor Pro Developer Turned Updates Into a Backdoor on 1,500 WordPress Sites

Jānis Elsts, the developer of the premium Admin Menu Editor Pro plugin for WordPress, has reported that his infrastructure was compromised. On Monday, an unknown party gained access to the adminmenueditor.com site and uploaded version 2.35, passing it off as a regular update to the paid version of the plugin.

The update contained an embedded file, includes/wp-user-consent.php, that installed a web shell on infected sites. The malicious PHP code also created a hidden user account. According to the developer's estimate, version 2.35 was available on the official site from roughly 06:00 to 13:00 UTC.

The free Admin Menu Editor is installed on more than 300,000 sites and lets administrators customize the dashboard menu, hide plugins from other users, restrict access by role, and set up redirects on login and logout.

A repeat compromise

Once he noticed the intrusion, Elsts removed the malicious update and, the same day at 19:00 UTC, released a clean version 2.36. However, the attacker still had access to the site and infected that version too. The investigation showed that the attacker likely had root-level access to the server, so the developer decided to take the site offline entirely until it could be restored.

According to an analysis of the update server logs, the initial attack affected about 230 customers, and the malicious version was installed on at least 1,500 sites — often several sites per customer. The real number of victims may be higher: it is difficult to determine how many users ran the trojanized version 2.36. Several hundred more customers downloaded the plugin during the dangerous time window and may also have been affected.

Signs of infection

Anyone who installed versions 2.35 and 2.36 should check their site for the following signs:

• the includes/wp-user-consent.php file in the admin-menu-editor-pro directory;
• a new /wp-content/object-cache/ directory;
• a user whose name begins with wp_ in the wp_users table (it may be hidden from the WordPress dashboard);
• options of the form wp_ocache* in the wp_options table.

Version 2.34 is considered clean, and the free version of the plugin appears to be unaffected.

The most reliable solution, according to Elsts, is to restore the site from a safe backup made before September 14. If that is not possible, he recommends deleting the plugin, the /wp-content/object-cache/ directory, and the specified database entries. The developer stressed that the incident was limited to his own infrastructure and apologized to the affected customers.

Source: Bleeping Computer