PHP Web Shell in Trojanized Admin Menu Editor Pro Plugin

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•3

This rule detects potential web shell activity within the 'Admin Menu Editor Pro' WordPress plugin. It searches for PHP files containing a combination of sensitive execution functions (e.g., eval, base64_decode, system) which are characteristic of the malicious code injected into versions 2.35/2.36 of the plugin during its supply chain compromise.