Hacker booby-traps WordPress sites using keys stolen from UpdraftPlus's developer
After an intrusion detected on October 17 and 18, the maker of the backup plugin probably had the keys to its management console stolen. Which versions to install, which key to delete and which traces to look for.
Translated from French by AI. The original French article is the reference version.
On October 18, shortly after 3:30 p.m. (UTC), WordPress sites began receiving plugin installation commands that no administrator had issued. The orders looked authentic: they were signed with real UpdraftCentral keys. UpdraftCentral is the console used to remotely manage sites running the UpdraftPlus backup plugin.
Where did those keys come from? That same weekend, TeamUpdraft, the developer of UpdraftPlus, detected unauthorized access to its teamupdraft.com website. In its notice, it says the hacker probably obtained its customer database: names, emails, billing addresses, order history, password hashes, two-factor authentication settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Payment cards, handled by Stripe and PayPal, are not affected, according to the company. The patched versions are UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), released on the evening of October 19.
One stolen key is enough to install a booby-trapped plugin
Slovak company Nethemba saw three of its own sites targeted on the night of October 18 to 19, and two received a booby-trapped plugin. Its sites were up to date: the attacker exploited no vulnerability. They sent commands signed with the console keys from their own server, and each site ran them with the rights of the user who had created the key. According to Nethemba, these keys never expire: some created in November 2025 still worked.
According to BleepingComputer, Patchstack has identified at least 99 malicious plugins, disguised as maintenance or optimization tools (“Site Health Cache,” for example). A first version, poorly coded, crashed the sites. The later ones let the attacker log in as an administrator or create an administrator account, which they try, unsuccessfully, to hide. On October 20, requests were still trying to wake up backdoors that had already been removed, Nethemba noted.
How many sites are exposed? TeamUpdraft does not say. BleepingComputer estimates that about 10% of UpdraftPlus sites have an UpdraftCentral or Migrator key, which could mean 400,000 sites.
The first patch deleted no keys
On October 19, version 1.26.12/2.26.12 was supposed to erase the keys that predated the incident. Because of a bug, it deleted none, according to Nethemba. Version 1.26.13/2.26.13 fixed this flaw the same evening. But, again according to Nethemba, it only erases keys created before 12:07 UTC on October 18, whereas the company sets the cutoff at 9 p.m. UTC: keys created between those two times still have to be deleted by hand. Another trap: when you log in to a teamupdraft.com account in the plugin, the box that adds the site to UpdraftCentral is checked by default.
Customer-hosted UpdraftCentral instances are not affected. Users of the free version without an account have nothing to do, according to the company.
What to do on your WordPress sites
The attack uses legitimate access, not a vulnerability, so updating the plugin is not enough.
- Install 1.26.13 or 2.26.13 (not 1.26.12).
- Under Settings, UpdraftPlus, Advanced Tools, UpdraftCentral, delete the existing connection keys, even if you no longer use the console. Also delete any Migrator keys you don't need.
- Look for unknown plugins, including in the must-use plugins tab, and for administrator or editor accounts created since October 17.
- In your logs, look for requests with the user agent “WordPress/6.4; class-udrpc.php”: Nethemba attributes them to the attacker, along with other indicators.
- Change your teamupdraft.com account password by typing the address yourself, reset two-factor authentication and change the administrators' passwords.
- If a backdoor worked, restore a backup from before October 17 and change the access keys to your storage spaces.
This is not the first time this week that a trusted tool has served as an entry point: the Rank Math PRO plugin distributed a booby-trapped update for eleven hours. TeamUpdraft, which notified the ICO, the UK data protection authority, has still not explained how the hacker got in.
Method: AI-assisted monitoring, verified sources, article reviewed and approved by Frédéric LENQUETTE. Our editorial policy.
Share this article
