Malicious Admin Menu Editor Pro Plugin Backdoors WordPress Sites

According to a report by BleepingComputer, malicious versions of the Admin Menu Editor Pro plugin for WordPress were distributed to more than 200 customers after a threat actor compromised the plugin maintainer's website. The attacker pushed updates that introduced a hidden user account with administrative capabilities into the affected installations. The exact method by which the maintainer's website was compromised has not been detailed in the report, though it is understood to have occurred prior to the distribution of the malicious updates. The hidden account allows attackers to gain administrative access to WordPress sites without detection, potentially enabling data exfiltration, site manipulation, and lateral movement within the compromised environment. The report estimates the total number of affected sites to be over 1,500. As of the report date, no public exploit code has been required to leverage the backdoor, as the access mechanism is built into the malicious plugin updates themselves. WordPress site owners using Admin Menu Editor Pro are advised to verify the integrity of their plugin installation and check for unauthorized administrator accounts.