Admin Menu Editor Pro shipped a backdoor. How to tell whether your site took it.

The usual advice is to keep plugins updated. On 14 September, for one plugin, updating is exactly what put a web shell on around 1,500 sites.

What happened

An attacker got access to the server distributing Admin Menu Editor Pro and published a build labelled 2.35 that carried a PHP web shell. Roughly 230 customers, covering about 1,500 sites, installed it before it was pulled. The developer replaced it with 2.36, and the attacker still had access, so that build went out compromised too. A clean build followed the same day.

Two details matter for everyone else. The free Admin Menu Editor on WordPress.org was not affected: this was the Pro distribution. And 2.34 is believed clean.

Wordfence carries it as Admin Menu Editor Pro 2.35 - 2.36, Backdoored Software, scored 9.8, with no patched version listed. That last part is the whole story: there is no version you can install that makes this go away.

Why the version number cannot clear you

Most vulnerability advice is a comparison. You are on 1.4.2, the fix is 1.4.3, update. That works because the flaw lives in the code, and replacing the code replaces the flaw.

This one is different in two ways. The malicious code ran once and left things behind that are not plugin files, so replacing the plugin does not remove them. And the same version string, 2.36, was used by both a compromised build and a clean one, so the number on your plugins screen does not say which bytes you got.

So the question is not "which version am i on". It is "did this site run one of those builds, and what is still here".

What to look for

These are the published indicators. Any one of them is worth stopping for:

• includes/wp-user-consent.php inside the admin-menu-editor-pro plugin directory. This is the web shell.
• A /wp-content/object-cache/ directory. Not the object-cache.php drop-in that real caching plugins install, which is a single file in wp-content. A directory with that name is the marker.
• User rows in the users table whose login starts with wp_. The account can be hidden from the users screen in wp-admin, so a clean-looking user list is not an answer here. Look at the table.
• Options named like wp_ocache in the options table.

The published guidance from the developer is to restore from a backup taken before 14 September 2026. If that backup does not exist, delete the plugin, the object-cache directory and the injected rows.

If you find one

Treat it as a compromise rather than a cleanup. A web shell that ran with your site's permissions had the same reach your plugins have: files, database, credentials, outbound requests. Removing the file closes the door it left open, and says nothing about what already walked through.

What that means in practice:

• Restore from a pre-14 September backup where one exists. It is the only step that answers the whole question at once.
• Rotate what the shell could read: administrator passwords, database credentials, salts in wp-config.php, and any third-party API keys stored on the site.
• Revoke Application Passwords and sessions. Neither is removed by deleting a file.
• Check administrators created since 14 September, and confirm each one with the person who runs the site rather than deciding from the name.
• Preview before deleting anything from the database, and keep a backup. A broad DELETE from a cleanup guide removes legitimate content just as happily.

Rotating database credentials is the one step that takes a site down when it goes wrong, because the new password and wp-config.php have to change together. Do that one deliberately, not at 2am.

If you run this on many sites

This is a premium plugin, so the sites running it are usually the ones somebody maintains for a client, which is also how twenty of them end up with the same update applied on the same afternoon.

Respira's WordPress vulnerability scanner lists every plugin and version on every connected site and matches them against the Wordfence Intelligence database, so finding which of your sites has this plugin at all takes one pass instead of twenty logins. The audit also reports administrators with their creation dates, which is the fastest way to answer the "who is this account" question across a fleet.

Being straight about the limits: an audit that asks WordPress for its administrators can be lied to by a plugin that filters the query, which is exactly what this backdoor is capable of. The file and database indicators above are the reliable check, and they are worth running on any site that took one of those builds, whatever a dashboard says.

Sources

• BleepingComputer: Malicious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
• Wordfence record: Admin Menu Editor Pro 2.35 - 2.36, Backdoored Software

Checked on 22 September 2026.