Admin Menu Editor Pro Update Vector Compromise: Web Shell and Hidden Administrator Distributed

1. Basic Information

1. 基本信息

Original Title: Security Incident Affecting Customers 2026-09-14 原标题： 2026-09-14 影响客户的安全事件

Source: Admin Menu Editor Pro and BleepingComputer 来源： Admin Menu Editor Pro 及 BleepingComputer

Publication Date: 2026-09-14 | Update Date: 2026-09-16 发布日期： 2026-09-14 | 更新日期： 2026-09-16

Severity: Emergency 严重程度： 紧急

Severity Justification: A malicious plugin was distributed through the official update channel, and traces of web shells and hidden users were reported on customer sites. Version 2.36, published as a clean version, was also tampered with, and root privileges may have been compromised on the distribution server. 严重性说明： 恶意插件通过官方更新渠道分发，客户站点报告了 Web shell 和隐藏用户的痕迹。作为“干净版本”发布的 2.36 版本也遭到篡改，分发服务器的 root 权限可能已被攻破。

Original Link: Security Incident Affecting Customers 2026-09-14 原始链接： 2026-09-14 影响客户的安全事件

Related Source: BleepingComputer: Malicious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites 相关来源： BleepingComputer：恶意 Admin Menu Editor Pro 插件后门影响 1,500 个 WordPress 站点

Related Entities: Web shell, Admin Menu Editor Pro, WordPress 相关实体： Web shell, Admin Menu Editor Pro, WordPress

2. Executive Summary

2. 执行摘要

The official distribution infrastructure of Admin Menu Editor Pro was compromised, and code that deploys a web shell was mixed into version 2.35 and some instances of version 2.36. Initial reports indicated deployment to approximately 230 customers and 1,500 sites, and the developer recommends recovery from pre-compromise backups and changing credentials. Admin Menu Editor Pro 的官方分发基础设施遭到入侵，部署 Web shell 的代码被混入 2.35 版本及部分 2.36 版本实例中。初步报告显示约有 230 名客户和 1,500 个站点受到影响。开发者建议从受感染前的备份中恢复数据并更改凭据。

3. Attack Flow

3. 攻击流程

Flow 1: Supply Chain Compromise Using Official Plugin Updates 流程 1：利用官方插件更新进行供应链攻击

An attacker breaches the official distribution infrastructure and places malicious version 2.35 as an update package. An administrator or the automatic update feature downloads and installs the package. Once the malicious code inside the plugin executes, includes/wp-user-consent.php deploys a web shell. On compromised sites, traces of persistence have been reported, including hidden users, PHP files, database options, MU plugins, and WP-Cron. The same behavior has not been confirmed across all installations. Even after the developer removed version 2.35 and published version 2.36, the distribution infrastructure compromise persisted, and malicious code was also mixed into some instances of version 2.36. 攻击者入侵官方分发基础设施，并将恶意 2.35 版本作为更新包放置。管理员或自动更新功能下载并安装该包。一旦插件内的恶意代码执行，includes/wp-user-consent.php 就会部署一个 Web shell。在受感染的站点上，已报告存在持久化痕迹，包括隐藏用户、PHP 文件、数据库选项、MU 插件和 WP-Cron。并非所有安装实例都确认存在相同行为。即使在开发者移除 2.35 版本并发布 2.36 版本后，分发基础设施的入侵状态依然持续，恶意代码也被混入到部分 2.36 版本实例中。

4. Attacker Position and Execution Location

4. 攻击者位置与执行位置

The attacker has compromised the plugin developer’s distribution server. On customer sites, the mixed-in PHP code runs with the privileges of the process executing WordPress. The suspicion of compromised root privileges comes from the distribution server description and is distinct from customer server privileges. 攻击者已攻破插件开发者的分发服务器。在客户站点上，混入的 PHP 代码以执行 WordPress 的进程权限运行。关于 root 权限被攻破的怀疑源于分发服务器的描述，这与客户服务器的权限不同。

5. Visibility for Victims and Administrators

5. 受害者与管理员的可见性

Victims Inference: General site users may not see the update process and might notice no screen anomalies after the compromise. 受害者推断： 普通站点用户可能看不到更新过程，且在入侵后可能不会注意到屏幕异常。

Administrators: The update appeared as a normal plugin update to administrators. Hidden users may not be visible in the admin dashboard, but the developer provides instructions on how to directly check the wp_users table. Even if the plugin is deleted, web shells or traces of persistence placed in other locations may remain. 管理员： 对管理员而言，该更新看起来像是一次正常的插件更新。隐藏用户在管理仪表板中可能不可见，但开发者提供了如何直接检查 wp_users 表的说明。即使删除了插件，放置在其他位置的 Web shell 或持久化痕迹可能依然存在。

6. Success and Failure Conditions

6. 成功与失败条件

Success Conditions: The modified version 2.35 or 2.36 is installed, and the malicious code executes on WordPress. Downloading and execution are distinguished. Deploying web shells or persistence requires write access to the target files or database with WordPress execution privileges. During the phase of operating the web shell via HTTP, requests from the attacker must reach the deployment destination and execute as PHP. Stopping this communication does not rule out the execution of malicious code or the creation of hidden users during installation. 成功条件： 安装了修改后的 2.35 或 2.36 版本，且恶意代码在 WordPress 上执行。下载和执行是两个不同的阶段。部署 Web shell 或持久化需要具备 WordPress 执行权限，并对目标文件或数据库拥有写入权限。在通过 HTTP 操作 Web shell 的阶段，攻击者的请求必须到达部署目标并以 PHP 形式执行。停止此通信并不能排除安装过程中恶意代码的执行或隐藏用户的创建。

Failure Conditions: The developer recommends removing versions 2.35 and 2.36 and, if possible, recovering from backups created before September 14. Recovery is a post-compromise response and does not revoke past information theft. 失败条件： 开发者建议移除 2.35 和 2.36 版本，并尽可能从 9 月 14 日之前的备份中恢复。恢复属于事后响应，无法撤销过去的信息窃取。

Inference: Package verification by a trusted comparison source independent of the compromise source, or finding modifications through staged updates, can limit the expansion of deployment. Hashes provided by the same compromised source cannot guarantee safety. 推断： 通过独立于受损源的受信任对比源进行包验证，或通过分阶段更新发现修改，可以限制部署的扩散。由同一受损源提供的哈希值无法保证安全性。

Inference: While WAFs may block suspicious HTTP requests to deployed web shells, they do not necessarily prevent code execution within the server associated with plugin updates. File write and execution controls must be verified on the server side. 推断： 虽然 WAF 可能拦截针对已部署 Web shell 的可疑 HTTP 请求，但它们不一定能阻止与插件更新相关的服务器内部代码执行。必须在服务器端验证文件写入和执行控制。

7. What Happens Upon Success

7. 成功后的后果

The developer recommends responding as if the attacker gained full control of the site on sites where a web shell was deployed. Access may persist even after deleting the plugin due to hidden users or multiple persistence methods. The scope of information theft from individual sites or the expansion of compromise to other sites has not been publicly disclosed. 开发者建议，在部署了 Web shell 的站点上，应采取“攻击者已获得站点完全控制权”的应对措施。由于隐藏用户或多种持久化手段的存在，即使删除插件，访问权限也可能持续存在。从单个站点窃取信息的范围或入侵向其他站点的扩散情况尚未公开披露。

8. Observable Logs

8. 可观测日志

Email Inference: The recipient address and receipt time of notifications from the developer can be used to identify investigation targets. Since notification targets are considered incomplete, non-receipt cannot be used as proof of safety. 电子邮件推断： 开发者通知的收件人地址和接收时间可用于确定调查目标。由于通知对象被认为不完整，未收到通知不能作为安全的证明。

Proxy / SWG / DNS Inference: Check DNS or outbound traffic logs for unknown destination communications that began after the update. Specific outbound C2 destinations are not indicated in the referenced official guidance. 代理 / SWG / DNS 推断： 检查更新后出现的未知目的地通信的 DNS 或出站流量日志。参考的官方指南中未指明具体的出站 C2 目的地。

Endpoint / EDR Inference: Check file change records or EDR for wp-user-consent.php, PHP under object-cache, MU plugins, and web server child processes. 终端 / EDR 推断： 检查文件更改记录或 EDR，查找 wp-user-consent.php、object-cache 下的 PHP 文件、MU 插件以及 Web 服务器子进程。

Identity / IdP Inference: Review WordPress audit logs for user creation and login events, and compare snapshots of the wp_users table to identify added or modified accounts. Check hosting management dashboards, FTP, etc., via their respective authentication logs. 身份 / IdP 推断： 查看 WordPress 审计日志中的用户创建和登录事件，并对比 wp_users 表的快照以识别新增或修改的账户。通过各自的身份验证日志检查托管管理仪表板、FTP 等。

SaaS / Cloud Inference: Check configuration changes and suspicious usage in audit logs for hosting, CDN, backups, and integrated APIs. SaaS / 云推断： 检查托管、CDN、备份和集成 API 的审计日志中的配置更改和可疑使用情况。

Network Inference: Examine web access logs for requests to web shells and cross-reference them with traffic logs. Request records alone cannot confirm command execution or data theft. 网络推断： 检查 Web 访问日志中对 Web shell 的请求，并将其与流量日志进行交叉比对。仅凭请求记录无法确认命令执行或数据窃取。

9. Attack Success Determination

9. 攻击成功判定

Confirmed in Public Information: 公共信息确认：

Malware Execution or Successful Authentication Confirmed: 恶意软件执行或身份验证成功确认：

Public Information: The developer has documented user-reported indicators of compromise, including web shells, hidden user accounts, and persistence artifacts. 公共信息： 开发者已记录了用户报告的入侵指标，包括 Web shell、隐藏用户账户和持久化痕迹。