WordPress Plugin Backdoor Hits 1,500+ Sites: How to Check Yours

A supply-chain attack on a popular WordPress plugin has quietly backdoored more than 1,500 small business websites, and most of the owners have no idea yet.

Attackers compromised the website of Admin Menu Editor Pro, a widely used premium WordPress plugin, and pushed malicious updates out to paying customers. As BleepingComputer reported, the tampered versions planted a hidden web shell and a concealed administrator account on more than 1,500 sites across 230-plus customers, giving attackers a quiet way back in even after the plugin itself is removed.

This slips past most small businesses because the update came from a source they already trust, so there's no dodgy link to spot. If your site runs Admin Menu Editor Pro, check your users list for accounts you don't recognise (especially ones starting with "wp_"), and look in the plugin folder for a file called wp-user-consent.php. Found either? Restore from a clean backup and reset every password tied to that site, don't just delete the plugin and move on. We manage websites for clients across Sydney, the Northern Beaches, Central West NSW and Brisbane, and the pattern we see constantly is that most owners can't tell you which premium plugins are even running on their site, let alone who maintains them. That blind spot is exactly what this attack exploited.

Written by Michael Sacco, Head of Service Delivery, All IT Services. All IT is a Sydney-based managed IT provider supporting hospitality, not-for-profit and wealth management businesses across Australia.