Developer Janis Elsts's incident notice for Admin Menu Editor Pro (published 14 September 2026, last updated 20 October) says a malicious admin-menu-editor-pro.zip was uploaded to adminmenueditor.com on 14 September 2026 and showed up as a version 2.35 update; it included a new file, includes/wp-user-consent.php, that installs a web shell. A clean 2.36 was released the same day, but later on 14 September 2.36 was also compromised; the developer says the attacker may have had root-level access to the server, which he took offline.

He says anyone who installed 2.35 should treat the site as compromised and anyone who installed 2.36 as potentially compromised, particularly if downloaded after 19:00 UTC; 2.34 should be clean. He estimated that about 230 customers were affected in the initial compromise, often with multiple sites each, and identified about 300 more potentially affected customers from downloads in or near the window.

Signs he lists from user reports: a new /wp-content/object-cache directory holding a hex-named web shell, wp_ocache or _wp_ocache_ options, a hidden user named wp_ followed by hex characters, hex-named MU-plugins and a _wp_cconsent_tick WP-Cron event. He advises restoring from a backup made before 14 September, or deleting the plugin and those artefacts, then changing all WordPress passwords, regenerating keys and salts and rotating other credentials stored on the site.

According to BleepingComputer (15 September), Elsts said 2.35 was available from about 06:00 to 13:00 UTC, its code also created a hidden user account, the malicious build was installed on at least 1,500 sites, and the free Admin Menu Editor does not appear to be affected.

Updated 25 Oct 2026: the developer says the update server has been rebuilt, downloads, licence activation and renewals are working again, and version 2.37.1 (based on the last known safe version, 2.34) adds optional checksum and signature verification for plugin updates.

Primary: developer incident notice; wire: BleepingComputer.

Correction (25 Oct 2026): the card now leads with the developer's incident notice, which says 2.36 was also compromised and gives about 230 customers in the initial compromise plus about 300 more potentially affected; the 06:00–13:00 UTC window, the 1,500-site count and the free-edition note are credited to BleepingComputer. (source: Admin Menu Editor Pro developer incident notice)