The AME Site is DOWN

Bad news, the site was compromised by an unknown attacker. My initial attempts to fix that were unsuccessful, so I’ve taken it down for investigation. I suspect that will take a while, probably more than a day or two.

As far as I know, the free version of Admin Menu Editor has not been affected. The site in question is used to host the Pro version, while the free version is here, on WordPress.org. Looking at SVN history for the free version, I don’t see any changes in September.

However, just in case I’m mistaken about that: if you see any updates for the free version in the next few days, please hold off from installing them. I don’t have any immediate updates planned. If anything shows up, it could be malicious.

Unfortunately, that’s unclear. It was safe initially – 2.36 was a clean version that I released to replace the malicious 2.35 update. However, several hours later the attacker modified the update file again. This time it was up for a much shorter time that the initial compromised version, but depending on when exactly you downloaded 2.36, it could be unsafe. I recommend restoring any site that downloaded 2.35 or 2.36 from a backup made before September 14.

My understanding of WordPress.org rules is that this forum is supposed to be only for providing support for the free version, so I’m not sure if I’m allowed to further comment on Pro version issues here. Unfortunately, with my server offline, my other sites and my primary email are also down. So I don’t have a good alternative contact method to offer to any Pro users who may find this thread. Perhaps you could try my Gmail address: daerils@gmail.com However, please note that it’s past midnight, and I probably won’t be able to respond quickly.