WordPress sites were backdoored through valid UpdraftCentral management keys after TeamUpdraft detected unauthorized access to its infrastructure. The vendor believes its customer database was accessed and replaced potentially affected keys and credentials. Researchers said attackers used stolen keys to install malicious plugins and create administrator access. Around 400,000 websites may have had an UpdraftCentral or Migrator key and therefore potential exposure.
Why It Matters
Current WordPress and plugin versions did not stop commands signed with valid dashboard keys. Researchers recorded at least 99 malicious backdoor plugin names, while one firm reported successful installation on two of its sites. For leaders: central management credentials can turn one vendor incident into risk across many websites. For defenders: remove old connection keys, inspect files and logs, and recover compromised sites from clean backups. The larger lesson is that valid third-party access can bypass normal patch-based defenses.
What Defenders Should Do
Update UpdraftPlus to 1.26.13 or 2.26.13 or later, delete existing connection keys and investigate every connected site.