Summary
- Nethemba documented valid UpdraftCentral commands at three websites on 19 October; two installed malicious plugins and one attempt failed.
- TeamUpdraft reported unauthorised access to its customer website, whose database held service connection keys.
- UpdraftPlus 1.26.13 corrects the emergency key-revocation release; site checks remain necessary for backdoors installed earlier.
Attackers used valid remote management keys associated with UpdraftCentral to install malicious plugins on connected WordPress websites, according to incident analysis published on 19 October. Security consultancy Nethemba identified unauthorised commands against three of its sites, while UpdraftCentral operator TeamUpdraft separately confirmed that attackers had accessed its customer website and may have obtained connection credentials stored there.
UpdraftCentral lets administrators manage multiple WordPress websites remotely through connections established by the UpdraftPlus plugin. A connected site accepts authenticated management commands with the permissions of the WordPress user who authorised that connection, including plugin installation where that user has sufficient privileges. The attacker therefore used a legitimate route for administrative changes; the observed access did not depend on exploiting a newly unpatched WordPress installation.
Nethemba says the attacker reached its three websites during the early hours of 19 October and submitted remote plugin installation commands authenticated with valid dashboard keys. Two sites installed and activated previously unknown plugins; the third rejected the attempt because the user associated with its key lacked permission to install software. That differing outcome provides a concrete example of how privileges attached to a remote management identity can determine the effect of compromised credentials.
The consultancy identified the intrusion after one of the malicious plugins generated a fatal error and interrupted normal WordPress requests. Examination of access logs, plugin files and the UpdraftCentral command log then linked the installation to the recognised remote management channel. One attempted backdoor was designed to create an account with concealed administrative powers and provide subsequent access, but the researchers said the plugin contained an implementation error that prevented its intended function and instead caused website failures.
Nethemba tested explanations including direct administrator login, an earlier UpdraftCentral authentication flaw and tampering with plugin files. The sites were running current WordPress and UpdraftPlus versions, and its forensic checks did not support those routes. The consultancy concluded that the commands had been signed with valid dashboard private keys that were not stored on the affected sites. That points to exposure of remotely held management credentials, although the exact theft mechanism had not been established.
TeamUpdraft separately disclosed unauthorised access to its customer website during 17–18 October. The company said it believed its customer database had been accessed; that database held names, email addresses, billing addresses, purchase records, hashed passwords, two-factor authentication settings and connection keys for its services. The vendor did not say every listed field had been extracted, and it confirmed that payment card details were processed by external payment providers rather than stored in the database.
The vendor said that UpdraftPlus plugin downloads and customer backups in their own remote storage had not been affected, and that self-hosted UpdraftCentral deployments were outside the identified incident. Its notice, last updated on 19 October, described an emergency plugin release as still in preparation. That release subsequently became available: UpdraftPlus 1.26.12 was issued on 19 October to revoke older UpdraftCentral Cloud keys, followed by 1.26.13 to correct how the revocation was applied. The corresponding Premium fixes follow the 2.26.13 version line. The vendor also instructed hosted users to disconnect existing connections directly and inspect their sites for unauthorised changes.
The affected population is narrower than UpdraftPlus’s reported four million active installations. The remote command route exists only where a site has an active, relevant UpdraftCentral connection; sites using the backup plugin without that connection cannot be reached through the mechanism documented here. Nethemba directly established two malicious plugin installations and one failed attempt across its three sites. The total number of compromised keys or other affected websites was not established in the public disclosures.
Patchstack’s separate analysis likewise describes misuse of correctly authenticated management commands rather than a new failure in the plugin’s signature verification. The earlier patch for a different UpdraftCentral authentication vulnerability did not invalidate genuinely stolen dashboard keys. Although the corrected October release addresses revocation of older Cloud connections, that does not establish that every relevant connection has been removed or that a website is clean. Malware installed through an authenticated command can remain after the management connection is disabled. Stopping further commands and identifying unauthorised changes already made are separate tasks.
On the affected Nethemba sites, plugin files and remote command logs connected the suspicious installations to the management service. One malicious plugin had malfunctioned and caused a website error, prompting discovery; the attempted backdoor did not achieve its intended behaviour on that site. Elsewhere, an attacker using the same privileges could make changes that are harder to detect. TeamUpdraft advised users of its hosted service to review administrator accounts and installed plugins, change administrator passwords and check for unexpected site modifications.
By 21 October, the corrected emergency version was available, but TeamUpdraft’s incident notice still carried a 19 October last-updated date and did not establish how many customer keys had been exposed. The company’s documented response remained to invalidate hosted UpdraftCentral connections and examine the affected WordPress sites for unfamiliar plugins, administrator accounts and other changes that could survive a software update.
