An attacker is using stolen UpdraftCentral keys to install backdoor plugins on WordPress sites. Patchstack says the campaign ran through an 18-hour window on October 18 and 19. As of October 19, no plugin update stops it.

What is happening

UpdraftCentral is the remote dashboard for managing UpdraftPlus sites. Each connected site holds a key that proves commands come from the dashboard. Patchstack says the attacker has genuine dashboard keys and sends signed commands that tell your site to install a plugin.

Because the commands are valid, the plugin accepts them. Patchstack says this is a key compromise, not a code flaw, so there is no CVE. The latest releases, 1.26.11 and 2.26.11.26, are affected just like older ones. TeamUpdraft has published a security incident post about what happened.

Who is affected

Any site running UpdraftPlus, free or premium, with an active UpdraftCentral key. Patchstack says connecting a TeamUpdraft.com account pre-ticks an UpdraftCentral checkbox. You may hold a key you never knowingly created. Keys do not expire.

What the backdoor does

The planted plugin waits for a secret web address containing a 32-character token. When triggered, it creates a hidden account with an Editor label that also holds admin-level powers. It logs the visitor in directly, which skips the login form and two-factor authentication. The account stays even after the plugin is removed.

What to do now

  1. Delete your UpdraftCentral keys. In wp-admin, go to Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral. Choose “Manage existing keys” and delete every key. Removing the site from the dashboard is not enough, because the key lives on your site.
  2. Check for a backdoor. Look for plugins with the description “Small maintenance toolkit: keeps option storage tidy.” Names are randomized, so do not rely on them. Also look for users with the Editor role who can manage options.
  3. Expect backups to keep working. Deleting keys only stops remote management.

If you find a backdoor, delete the keys first. Deactivate the plugin rather than deleting it in wp-admin, because its uninstall routine erases traces. Do not try to fix its errors, since that can activate it.

Treat the site as fully compromised if the plugin or hidden account exists. Restore from a backup made before October 18, rotate admin passwords, end all sessions, and turn on two-factor authentication.

Patchstack also notes an earlier UpdraftCentral flaw, fixed in UpdraftPlus 1.26.5 in June. Make sure you are past that version too. We covered that earlier fix at the time.

End of article