Malicious Admin Menu Editor Pro Plugin Backdoors 1,500 WordPress Sites

A compromised update server for the premium WordPress plugin Admin Menu Editor Pro was used to distribute trojanized releases (v2.35 and a re-compromised v2.36) that installed a disguised web shell (includes/wp-user-consent.php), created hidden admin accounts and persisted via object-cache/options artifacts; at least 230 customers and roughly 1,500 sites are confirmed affected and site owners should check the listed IoCs, restore from clean backups if possible, rotate credentials, and avoid updating until the update infrastructure is verified secured.