Attackers abuse stolen UpdraftCentral keys to install backdoor plugins on connected WordPress sites

TeamUpdraft disclosed that attackers breached its website over the October 17 weekend and reached its customer database, obtaining names, emails, hashed passwords, 2FA settings, and the UpdraftCentral connection keys that let them push backdoor plugins to connected WordPress sites. UpdraftPlus, a backup plugin with over four million installs, ships an UpdraftCentral client in every copy. Patchstack saw signed plugin.upload_plugin commands over an 18-hour window and 99 backdoor plugin names, and one backdoor creates a persistent data-ops43 editor account that survives plugin removal. Fixes are in UpdraftPlus 1.26.13 and 2.26.13, which disconnect pre-incident UpdraftCentral connections. Site owners should rotate keys and hunt for rogue accounts.

Check

Update UpdraftPlus to 1.26.13 or 2.26.13, delete the UpdraftCentral connection key, and check WordPress sites for unknown admin or editor accounts and plugins.

Affected

WordPress sites connected to cloud UpdraftCentral could receive attacker-pushed backdoor plugins and a persistent data-ops43 account that survives plugin removal and normal login unless 2FA blocks it.

Fix

Apply the fixed UpdraftPlus release, rotate UpdraftCentral and storage keys, remove rogue accounts and plugins including must-use plugins, and restore from a pre-October-17 backup if needed.