A malicious version of the popular Admin Menu Editor Pro plugin recently compromised over 1,500 WordPress websites. Attackers successfully breached the developer's official distribution website and pushed unauthorized updates to more than 200 paying customers, silently establishing hidden administrator accounts to maintain persistent access across the target network.
The security incident began when unauthorized actors gained access to the primary server infrastructure used by the plugin developer. Instead of delivering legitimate feature updates and security patches, the compromised platform distributed trojanized software packages.
Once installed on a WordPress site, the modified plugin executes a hidden routine. It immediately creates a secret administrative user account without the site owner's knowledge or consent. This stealthy approach ensures the attackers retain full control over the underlying database and web files even if standard login credentials are changed.
Security telemetry indicates the scale of the compromise expanded rapidly as automated update systems pulled the infected package. Site administrators who rely on automated routines for plugin maintenance became unwitting accomplices in deploying the backdoor across their own digital properties.
Cleaning up after this supply chain attack requires immediate manual auditing of all existing WordPress user accounts. Webmasters must inspect their backend user lists for any unfamiliar administrator profiles created without authorization.
The broader implications of this incident highlight the persistent risks surrounding software supply chains in the content management ecosystem. Developers face mounting pressure to secure their distribution channels against sophisticated intrusions that weaponize routine update mechanisms.