Security Incident Affecting Customers 2026-09-14

Published September 14, 2026 · Last updated September 16, 2026

If you installed Admin Menu Editor Pro version 2.35, treat the site as compromised. If you installed version 2.36, treat the site as potentially compromised. See what to do below.

Summary

On September 14, 2026, I discovered that a malicious version of admin-menu-editor-pro.zip had been uploaded to adminmenueditor.com as a new version of the Admin Menu Editor Pro plugin. This showed up as a version 2.35 update to users who had the plugin active. This version included a new file includes/wp-user-consent.php that installs a web shell on the user's site.

I removed the malicious update and attempted to resolve the intrusion. A clean version 2.36 was released the same day. However, later on September 14, version 2.36 was also compromised. Investigation of the second intrusion showed that the attacker may have obtained root-level access to the server.

How to check if you're affected

You're affected if you installed version 2.35 of Admin Menu Editor Pro on September 14, 2026. If you installed version 2.36, you may also be affected, particularly if you downloaded it after 19:00 UTC. See the additional check below. Version 2.34 should be clean.

Additionally, you can check for the presence of the web shell and other malicious activity. Things to check for (based on user reports):

A new /wp-content/object-cache directory that contains a subdirectory with the web shell PHP script. The subdirectory and script will likely have names composed of hex characters.
New option(s) in the wp_options table with a name that starts with wp_ocache or _wp_ocache_.
A new user whose login is wp_ followed by hex characters. The user likely won't appear in the admin dashboard, but should show up if you directly query the wp_users table.
MU-plugins (in /wp-content/mu-plugins) named wp- followed by hex characters.
A WP-Cron event name _wp_cconsent_tick.

Recommendations for affected users

Because the payload is a web shell, you should assume the attacker had full control of the site. If possible, restore the affected site from a backup made before September 14.

Alternatives

I don't currently have a full understanding of the malicious payload, so the rest of these recommendations may be insufficient.

If you have version 2.35 of Admin Menu Editor Pro installed, delete it immediately. Some version 2.36 downloads were also compromised, so if you have that version installed, it's recommended to delete it as well.
Delete the /wp-content/object-cache directory. The /wp-content directory may also contain a file named object-cache.php. Some caching plugins create this file for legitimate reasons. If you're using a caching plugin, don't delete this file unless you know what you're doing.
Check the wp_users table and delete the hidden wp_… user if present. Remove the wp_ocache... / _wp_ocache_... options, the _wp_cconsent_tick event, and any hex-named MU-plugins described above.
Change the passwords of all WordPress users, regenerate the security keys and salts in wp-config.php, and rotate other credentials stored on the site (database, FTP/SFTP, hosting panel, API keys for third-party services).
Run a full malware scan and review files modified since September 14.

Status Updates

Investigation is ongoing. This page will be updated with additional information if/when it becomes available.

Update 2026-09-15 21:34 UTC

A user has reported additional details about signs of compromise on their site, such as options named _wp_ocache_ (instead of wp_ocache) and a WP-Cron event named _wp_cconsent_tick. I've added these to the relevant section above.

Update 2026-09-15 21:03 UTC

Finished sending email notices to affected customers.

Again, even if you haven't received an email from me, that does not necessarily mean you were not affected. My current list of affected customers is likely to be incomplete. Checking your site for malicious files and activity is still recommended.

Update 2026-09-15 19:21 UTC

Started sending security incident notices to affected customers. Look for an email from whiteshadow@w-shadow.com.

This will mainly cover customers that were affected during the initial compromise. Unfortunately, I don't yet have a reliable way to identify customers affected by the second stage of the attack. Shortly before taking the site offline, I saw evidence suggesting that the attacker may have tried to delete the relevant logs.

Even if you don't receive an email from me, you should not assume that you were not affected. As mentioned above, I don't currently have a comprehensive list of all affected customers. And, of course, automated emails can end up in spam, or the email address I have on file may be out of date.

Update 2026-09-15 14:44 UTC

I'm working on a static site (i.e. this one) to publish these updates.

Update 2026-09-14 ~21:40 UTC

Attempts to stop the intrusion are ineffective. Further investigation indicates the attacker could have root-level access to the server. I've decided to take the server offline. I'm notifying the hosting provider.

This update was added after the fact. The timestamp may be inaccurate.

Update 2026-09-14 ~19:35 UTC

A repeat intrusion was detected.

This update was added after the fact. The timestamp may be inaccurate.

Update 2026-09-14 18:00 UTC

After further analysis, ~300 additional potentially affected customers have been identified. This is based on downloads in or near the relevant time window, not specific version numbers, so it's less reliable.

Update 2026-09-14 16:37 UTC

The current estimate is that about 230 customers were affected [in the initial compromise], often with multiple sites per customer.