[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5jDxU2eDIq7z8kfgvMikXB_IJ3FhxMGt2C57I2a8kpQ":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"a52c5cb2-ff84-4af5-8ca9-91d23f036e50","Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites","malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites-85fda3","Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer's website and pushed updates that created a hidden user account. [...]","A threat actor compromised the Admin Menu Editor Pro plugin's website, pushing malicious updates that created hidden user accounts and installed web shells on over 1,500 WordPress sites. The developer attempted to remove the malicious code, but the attacker re-compromised the site and the updated plugin. The website has been taken offline for restoration, and users are advised to restore from backups or manually remove malicious files and database entries.","Malicious Admin Menu Editor Pro plugin updates backdoor 1,500 WordPress sites.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmalcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F06\u002F18\u002FWordPress.jpg","2026-09-15T20:34:15+00:00","2026-09-15T22:00:21.486323+00:00",8,[17,20],{"name":18,"type":19},"Admin Menu Editor Pro","product",{"name":21,"type":22},"WordPress","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":23,"icon":25,"name":26,"slug":27},null,"Supply Chain","supply-chain",[29,31,36,41],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":40,"value":48,"context":49},"wp-user-consent.php","Malicious file installed by the compromised plugin.",[18],{"controls":52,"vendors":140},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":83,"name":84,"problem":85,"products":86},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"slug":112,"name":113,"problem":114,"products":115},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":156},"compromised-wordpress-plugin-backdoors-1500-sites-via-malicious-updates","Compromised WordPress Plugin Backdoors 1,500 Sites via Malicious Updates","A threat actor gained access to the Admin Menu Editor Pro plugin's distribution infrastructure and pushed trojanized updates that silently installed web shells and created hidden admin accounts on over 1,500 WordPress sites. This is a classic software supply chain attack — users trusted a legitimate update channel, not knowing the source had been compromised. The developer's initial remediation failed because the attacker retained persistent access and re-compromised the site, highlighting the danger of incomplete incident response. This incident underscores why blindly auto-updating third-party plugins without integrity verification can be as dangerous as running outdated software.",[146,147,148,149,150,151,152,153,154,155],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","NIST SP 800-161: Supply Chain Risk Management","NIST IR-4: Incident Handling","NIST SI-7: Software, Firmware, and Information Integrity","NIST CP-9: Information System Backup","GDPR Article 32: Security of Processing","ITIL Change Management: Controlled Software Updates","OWASP A08:2021 – Software and Data Integrity Failures",{}]