Patchstack said on 19 October that an attacker is using valid UpdraftCentral keys to install backdoor plugins on WordPress sites. UpdraftCentral is a remote control service from the maker of UpdraftPlus, a backup plugin with over four million active installs. Patchstack's own data shows installs between 15:32 on 18 October and 09:23 on 19 October. Nethemba, a security company, first found the attack on its own sites. Patchstack said each backdoor creates a hidden account that looks like an Editor but can install plugins. It counted 99 different plugin names.
Patchstack said this is not a flaw in UpdraftPlus. The commands carry genuine signatures, so every check on the site passes. As of 19 October, it said the campaign was active and the vendor had no fix. Patchstack said the evidence points to keys leaking from the UpdraftCentral Cloud service. TeamUpdraft had not yet given an explanation. Patchstack did not say how many sites are affected. It called the set of sites broad.
Patchstack said many sites hold a key nobody meant to create, because a box on the TeamUpdraft.com login screen is ticked by default. Owners who only use UpdraftPlus for backups may still be exposed. Patchstack advises deleting every UpdraftCentral key on each site. It says backups keep working afterwards, and only remote management stops.