GoKawiilAdmin Menu Editor Pro update server hacked, plugin backdoored on 1,500 WordPress sites
A threat actor breached the website of Admin Menu Editor Pro maintainer Janis Elsts and pushed a malicious version 2.35 update that installed a web shell and created a hidden admin account on customer sites. Even after Elsts released a clean version 2.36, the attacker retained access and compromised that release too, affecting an estimated 230 customers and at least 1,500 sites.
GoKawiil's interpretation of the reporting above, not reported fact.
The plugin's free version runs on over 300,000 WordPress sites, making this a significant supply-chain risk since attackers can gain persistent backdoor access far beyond the initial breach point. The fact that the attacker had likely root-level server access shows how a single compromised maintainer infrastructure can undermine trust in software update mechanisms across an entire user base.
- Malicious version 2.35 of Admin Menu Editor Pro was live for about 7 hours, installing a hidden admin account and web shell.
- Attacker retained access to the update server and also compromised the supposedly clean version 2.36.
- At least 230 customers and 1,500 sites were affected, with the true number potentially higher.
Source: bleepingcomputer.com, 2026-09-15
Published there as: “Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.