Stolen UpdraftCentral keys are backdooring WordPress sites

Stolen UpdraftCentral connection keys are being used to install backdoors on WordPress sites, after an attacker breached the infrastructure of TeamUpdraft, the developer behind UpdraftPlus and related tools. The company says it contained the intrusion, replaced potentially affected credentials and signed users out of their accounts.¹²

What happened

TeamUpdraft said unauthorised access to teamupdraft.com over the weekend of 17–18 October exposed customer and billing information, password hashes, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company says payment details were not stored and that UpdraftPlus plugin files and downloads were unaffected.¹

UpdraftCentral is a remote-management channel. Valid keys can send commands to connected websites, which means attackers did not need to exploit a fresh WordPress vulnerability to reach some targets. Patchstack says attacks began on 18 October, while Nethemba reported that stolen dashboard keys were used to sign commands and install malicious plugins on two of its three targeted websites.³⁴

BleepingComputer reports that researchers have identified at least 99 malicious backdoor plugins with different names, including maintenance and optimisation disguises. The potential reach is significant: an estimated 10% of sites using UpdraftPlus may have an UpdraftCentral or Migrator key, equivalent to roughly 400,000 sites.³

What administrators should do

TeamUpdraft recommends updating UpdraftPlus to 1.26.13 for the free version or 2.26.13 for Premium, then deleting existing UpdraftCentral connection keys from UpdraftPlus Backups' Advanced Tools area. Administrators should also inspect logs and files for the indicators of compromise published by TeamUpdraft, Patchstack and Nethemba. Confirmed compromises should be handled with clean backups, changed account passwords, revoked sessions and reset two-factor authentication.¹³⁴

Our opinion

This incident is a reminder that remote-management credentials can turn a trusted maintenance path into a mass compromise route. The key detail is that patched WordPress installations may still be exposed if a valid UpdraftCentral key is stolen, so updating the plugin alone is not enough: administrators also need to revoke old keys and check what those keys already did.