- Wordfence's report for October 19 to 25 counts 268 new WordPress plugin and theme vulnerabilities, and lists an UpdraftPlus entry titled "UDRPC key compromise".
- Check Point Research's bulletin says compromised UpdraftCentral keys were abused to install backdoors on WordPress sites. It describes an 18-hour campaign on October 18 and 19.
- A tally of flaws cannot show which outside services hold standing access to your sites. Organisations should ask who holds those keys and whether they can be rotated and revoked.
A weekly count tells you about bugs, not about standing access
Every week, a security vendor publishes a number, and the number is large. For October 19 to 25, Wordfence reported 268 vulnerabilities across 182 WordPress plugins and 15 themes. It said 124 researchers contributed to those findings.
That count tells you how many flaws were found and logged. It cannot tell you which outside services hold standing permission to act on your websites. Check Point Research's weekly bulletin describes a case where such access was reportedly abused. The lesson here is that a tally of bugs and a list of who holds keys to your sites answer different questions.
What the two sources say
Wordfence says its database holds more than 40,000 WordPress vulnerabilities. Its weekly report page lists an entry titled "UpdraftPlus <= 1.26.11 – UDRPC key compromise". So Wordfence did log a key-compromise entry for this vendor. The page excerpt we reviewed gives no detail on it. We cannot tell what kind of weakness it describes, or whether it sits inside the 268 count.
Check Point's bulletin, published October 26, covers TeamUpdraft, the developer of the WordPress backup tool. It says the company suffered a cyberattack after intruders accessed its website. Customer information and the keys that connect its management service to customer sites may have been exposed.
The bulletin then says compromised UpdraftCentral keys were misused to plant backdoors on WordPress sites. By its account, the activity lasted 18 hours and spanned October 18 and 19.
One caution. Wordfence's "UDRPC" entry and Check Point's "UpdraftCentral" keys involve the same vendor. The material we reviewed does not say how they connect, so we do not treat them as one finding.
How a compromised key becomes a backdoor
Check Point calls the exposed items management-service connection keys, and names them as UpdraftCentral keys. From that wording, a key appears to authorise the service to act on a site. Anyone who held a compromised key could then issue those commands. A backdoor is a hidden way back into a site, and Check Point says the attackers used the keys to install them.
The sources do not say how the keys are built or checked. They do not say whether a flaw in the plugin's code played a part. Wordfence files its entry against a plugin version range, which is how it records code vulnerabilities. Our argument rests on Check Point's description alone.
The sources also do not say how many sites were affected, or which versions or settings were involved. Those gaps are the first questions to put to the vendor.
General background: why one service holding many keys is a single point of failure
This section is general background, not a finding about UpdraftCentral. Management services work by holding a credential for each site they manage. Those credentials then sit together in one place, run by one company.
That design saves time for site owners. It also means an intruder who reaches the vendor's systems may reach every credential at once. The attacker does not need to break into thousands of sites one by one. Each key can open a door the owner never locked against that service.
The owner also cannot see how the vendor stores those keys. A breach at the vendor can matter more than a flaw in any single site. Whether that happened here is not something the sources establish.
Who carries the risk
The risk lands on the site owner. A small business that installed a backup tool did the responsible thing. It then depends on the vendor's own security, which the owner cannot see or test.
This is an old pattern in a new setting. A building manager hands a spare key to a trusted contractor. The building is only as secure as the contractor's key cabinet. Few people review that cabinet at the next lease renewal.
A weekly flaw count invites a particular habit. It prompts teams to ask how many plugins need updates. It does not by itself prompt the question of which outside services hold standing access to production sites.
What leaders should ask their teams
Start with an inventory. Ask for a list of every service that can change your websites remotely, including backup, management and deployment tools. Ask who owns each one.
Then ask about the keys. Where is each one stored, who can see it, and how fast can it be replaced? If the answer is "we are not sure", that is the finding.
Ask what the team does when a vendor reports a breach. A good plan names who replaces keys, who checks sites for unfamiliar files or admin accounts, and who decides whether to take a site offline.
Finally, ask whether TeamUpdraft has told its customers to replace their keys and check their sites. Check Point's bulletin points to possible exposure of both customer information and keys.
Wordfence's number will change next week. The question of who holds the keys to your site stays with you.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Wordfence.
