Attackers Abuse Updraft Central Keys to Plant Backdoors on Word Press Sites
Summary: Unknown attackers breached TeamUpdraft's website over the weekend of 17-18 October and potentially accessed customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, which were then used to install backdoor plugins on connected WordPress sites. Patchstack observed an attacker with valid UpdraftCentral dashboard keys sending signed plugin.upload_plugin commands over an 18-hour window on October 18 and 19, 2026, and Nethemba found the rogue plugin creates a 'data-ops43' account with Editor role plus manage_options and install_plugins permissions that persists after the plugin is removed.
Bottom line: UpdraftPlus has over four million active installations, and its client component ships inside every copy, so a single set of stolen connection keys reached an unknown share of those sites - and the backdoor's created account survives plugin removal unless two-factor authentication is enabled on it.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026