UpdraftCentral's stolen keys are backdooring WordPress sites
An attacker with valid UpdraftCentral dashboard keys installed a malicious plugin on WordPress sites overnight, no vulnerability required. UpdraftPlus has over four million installs and the vendor has not explained the leak.
Someone holding valid UpdraftCentral dashboard keys used them to install and activate a malicious plugin on two WordPress sites overnight, between 18 and 19 October, according to an incident writeup from Nethemba, one of the sites affected.
UpdraftCentral is the remote-management service built into UpdraftPlus, a backup plugin with more than four million active installations. UpdraftPlus’s own estimate is that under 10% of those have an UpdraftCentral or Migrator key connected, which still puts up to 400,000 sites within reach of this attack. The attacker, from a single IP address, sent the plugin.upload_plugin command correctly encrypted and signed with genuine dashboard private keys, starting with a probe at 00:41 UTC and succeeding on two of three sites by 06:53. Nethemba ruled out a bug in UpdraftPlus itself: the plugin files matched the official release byte for byte, the key fingerprints hadn’t changed, and the cryptography checked out. UpdraftPlus’s maker, TeamUpdraft, had not explained how the keys were obtained as of publication.
Why it matters: this isn’t a flaw a plugin update fixes, since the attacker holds valid keys rather than exploiting one. If you’ve connected a WordPress site to UpdraftCentral, disconnect it now from Settings > UpdraftPlus Backups rather than waiting for a patch.
The caveat: there’s no CVE and no vendor statement yet. Treat this as an open incident, not a resolved one, and don’t reconnect until TeamUpdraft explains what happened.