# Admin Menu Editor Pro shipped a backdoor. How to tell… > An attacker reached the vendor's update server and two builds went out with a web shell in them. The files, the directory and the database rows to look for… Source: https://www.respira.press/blog/admin-menu-editor-pro-backdoor-check --- The usual advice is to keep plugins updated. On 14 September, for one plugin, updating is exactly what put a web shell on around 1,500 sites. ## What happened An attacker got access to the server distributing Admin Menu Editor Pro and published a build labelled 2.35 that carried a PHP web shell. Roughly 230 customers, covering about 1,500 sites, installed it before it was pulled. The developer replaced it with 2.36, and the attacker still had access, so that build went out compromised too. A clean build followed the same day. Two details matter for everyone else. The free **Admin Menu Editor** on WordPress.org was not affected: this was the Pro distribution. And 2.34 is believed clean. Wordfence carries it as [Admin Menu Editor Pro 2.35 - 2.36, Backdoored Software](https://www.wordfence.com/threat-intel/vulnerabilities/id/8898bae3-067c-4505-9a96-05b7a08d90c6), scored 9.8, with no patched version listed. That last part is the whole story: there is no version you can install that makes this go away. ## Why the version number cannot clear you Most vulnerability advice is a comparison. You are on 1.4.2, the fix is 1.4.3, update. That works because the flaw lives in the code, and replacing the code replaces the flaw. This one is different in two ways. The malicious code ran once and left things behind that are not plugin files, so replacing the plugin does not remove them. And the same version string, 2.36, was used by both a compromised build and a clean one, so the number on your plugins screen does not say which bytes you got. So the question is not "which version am I on". It is "did this site run one of those builds, and what is still here". ## What to look for These are the published indicators. Any one of them is worth stopping for: - `includes/wp-user-consent.php` inside the `admin-menu-editor-pro` plugin directory. This is the web shell. - A `/wp-content/object-cache/` directory. Not the `object-cache.php` drop-in that real caching plugins install, which is a single file in `wp-content`. A directory with that name is the marker. - User rows in the users table whose login starts with `wp_`. The account can be hidden from the users screen in wp-admin, so a clean-looking user list is not an answer here. Look at the table. - Options named like `wp_ocache` in the options table. The published guidance from the developer is to restore from a backup taken before 14 September 2026\. If that backup does not exist, delete the plugin, the `object-cache` directory and the injected rows. ## If you find one Treat it as a compromise rather than a cleanup. A web shell that ran with your site's permissions had the same reach your plugins have: files, database, credentials, outbound requests. Removing the file closes the door it left open, and says nothing about what already walked through. What that means in practice: - Restore from a pre-14 September backup where one exists. It is the only step that answers the whole question at once. - Rotate what the shell could read: administrator passwords, database credentials, salts in `wp-config.php`, and any third-party API keys stored on the site. - Revoke Application Passwords and sessions. Neither is removed by deleting a file. - Check administrators created since 14 September, and confirm each one with the person who runs the site rather than deciding from the name. - Preview before deleting anything from the database, and keep a backup. A broad `DELETE` from a cleanup guide removes legitimate content just as happily. Rotating database credentials is the one step that takes a site down when it goes wrong, because the new password and `wp-config.php` have to change together. Do that one deliberately, not at 2am. ## If you run this on many sites This is a premium plugin, so the sites running it are usually the ones somebody maintains for a client, which is also how twenty of them end up with the same update applied on the same afternoon. Respira's [WordPress vulnerability scanner](https://www.respira.press/wordpress-vulnerability-scanner) lists every plugin and version on every connected site and matches them against the Wordfence Intelligence database, so finding which of your sites has this plugin at all takes one pass instead of twenty logins. The audit also reports administrators with their creation dates, which is the fastest way to answer the "who is this account" question across a fleet. Being straight about the limits: an audit that asks WordPress for its administrators can be lied to by a plugin that filters the query, which is exactly what this backdoor is capable of. The file and database indicators above are the reliable check, and they are worth running on any site that took one of those builds, whatever a dashboard says. ## Sources - [BleepingComputer: Malicious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites](https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/) - [Wordfence record: Admin Menu Editor Pro 2.35 - 2.36, Backdoored Software](https://www.wordfence.com/threat-intel/vulnerabilities/id/8898bae3-067c-4505-9a96-05b7a08d90c6) Checked on 22 September 2026. [#supply-chain](https://www.respira.press/blog?q=supply-chain)[#wordpress-security](https://www.respira.press/blog?q=wordpress-security)[#admin-menu-editor-pro](https://www.respira.press/blog?q=admin-menu-editor-pro)[#backdoor](https://www.respira.press/blog?q=backdoor) Found this useful? Share it. ## Join the *conversation* 0 comments · Respira account #### Sign in with your Respira account Comments are tied to your Respira login, the same account you use for the dashboard and plugin. No third-party sign-in, no scraping. [Sign in](https://www.respira.press/login?next=https%3A%2F%2Fwww.respira.press%2Fblog%2Fadmin-menu-editor-pro-backdoor-check%23comments) [Create an account](https://www.respira.press/signup?next=https%3A%2F%2Fwww.respira.press%2Fblog%2Fadmin-menu-editor-pro-backdoor-check%23comments) No comments yet. Be the first to weigh in. ### You're not the only one *talking* to WordPress. The Respira community is where agency owners debug Divi migrations at 11pm, where vibe coders swap prompts that actually ship, and where the roadmap gets written out loud. *Breathe with us.* Lines of code pushed 32,252,709 Live from the ecosystem · updates as the agent ships WordPress sites connected 3,756 Real sites, run by the people in these rooms Find us wherever you already are [ Slack Async threads, release-day huddles, and the #show-your-work channel that never sleeps. Join ](https://go.respira.cafe/slack) [ Discord Live voice on release days, screenshare debugging, and the vibe-coder corner that's always buzzing. Join ](https://go.respira.cafe/respira-discord) [ Reddit Questions, answers and build logs in the open, where the thread is still there months later. Join ](https://www.reddit.com/r/RespiraforWordPress/) [ Facebook group Agency owners and site owners comparing notes on running AI against real WordPress sites. Join ](https://www.facebook.com/groups/1447068940850273/) [ GitHub Discussions Long-form Q&A, bug reports, feature requests, and the public roadmap. Open ](https://go.respira.cafe/github-discussions) [ ! Founder notes Letters from Mihai on what shipped, what broke and what is next. Every one is archived. Read ](https://www.respira.press/newsletter) See What AI Says LLM-ready prompts about Respira MCP + WebMCP What would you like to know? Ask your favorite AI Opens in a new tab. These prompts are designed to teach LLMs what Respira can do. Question copied. Paste it in Gemini