Attacker with root on the Admin Menu Editor site poisoned the fix as well as the original update

Deleting the plugin does not end this. The malicious code in 2.35 wrote includes/wp-user-consent.php into the admin-menu-editor-pro directory and installed a web shell from there ^[3], and it created a user account whose name begins with wp_ in the wp_users table, which may not show up in the dashboard user list ^[4]. Two of the four indicators Elsts lists sit outside the plugin directory: a new /wp-content/object-cache/ directory, and options named wp_ocache* in wp_options ^[5].

The scope figures come from the developer's own update server logs. "Based on analysis of update server logs, approximately 230 customers were affected in the initial attack. The malicious version was installed at least 1500 sites (often multiple sites per customer)," Elsts told BleepingComputer ^[9]. That is roughly 6.5 sites per affected customer ^[2].

The first window was short. Version 2.35 sat on the official site from about 06:00 to 13:00 UTC ^[6], seven hours ^[1]. Elsts pulled it and pushed a clean 2.36 at 19:00 UTC the same day ^[7], six hours after the removal ^[3]. The attacker still had access to the website and compromised that build as well ^[8]. The investigation indicates root-level server access ^[13], and Elsts took the site offline until it could be restored with confidence ^[13].

How many sites took the tainted 2.36 is unsettled. Elsts says it is difficult to determine how many customers are running a trojanised 2.36, so the victim count may be higher than 1,500 ^[12]. "Several hundred additional customers downloaded the plugin in or near the relevant time window, and could have also been affected," he said ^[11]. Both builds reached customers through the plugin's normal Pro update channel on adminmenueditor.com ^[1], so a site that shows 2.36 in its plugin list has told the operator nothing about which 2.36 it got. The four indicators are the test.

The 300,000-plus install figure attached to this plugin belongs to the free Admin Menu Editor, which does not appear affected ^[16][15]. Version 2.34 is believed clean ^[15]. The exposed population is Pro licences that pulled an update on Monday ^[2].

Elsts calls a restore from a backup dated before September 14 the most reliable fix ^[17]. Where no such backup exists, he recommends deleting the plugin, the /wp-content/object-cache/ directory and the database entries listed above ^[18]. That leaves the hidden account and any use made of the web shell as the open question for every site in the 1,500 ^[10]. Elsts said the incident was limited to his own infrastructure and apologised to affected customers ^[19], and has published a static page with the indicators and cleanup steps ^[14].