Stolen UpdraftCentral Keys Used to Deploy Backdoors on WordPress Sites
Attackers are exploiting compromised UpdraftCentral dashboard keys to upload and activate malicious plugins, effectively backdooring WordPress sites.
A sophisticated attack campaign is currently underway, leveraging stolen UpdraftCentral dashboard keys to compromise WordPress websites. The campaign, which ran continuously for an 18-hour period between October 18th and 19th, 2026, involves attackers sending signed commands to upload and activate malicious plugins on affected sites. This method allows them to gain unauthorized access and control, effectively backdooring the websites.
This incident is classified as a remote management key compromise, not a traditional code vulnerability within the UpdraftPlus or UpdraftCentral software. As such, there is no immediate vendor fix available, and the latest versions of the software are as vulnerable as older ones if an UpdraftCentral key has been compromised. The commands sent by attackers are correctly encrypted and signed using genuine dashboard private keys, making them appear legitimate to the affected WordPress sites. This means that all security checks within the plugin pass, as the site perceives the instruction as valid.
UpdraftPlus is a widely used WordPress backup plugin, boasting over four million active installations. UpdraftCentral is its associated remote management service, and its client is integrated into every installation of UpdraftPlus. The client remains inactive until a site is issued a key, which generates an RSA key pair on the site and stores the dashboard's public key. From this point, the site is programmed to execute any command signed by the dashboard's private key, operating with the privileges of the user who established the connection. The security of all connected sites hinges on the assumption that these private keys remain secure within the UpdraftCentral Cloud service.
The attack mechanism involves the attacker sending a signed command, specifically plugin.upload_plugin, through the plugin's remote procedure call (RPC) channel. This channel operates over standard POST requests to the site's root directory. Upon receiving the command, WordPress proceeds to install and activate the provided plugin through its normal installation process. Researchers have ruled out site-specific explanations, confirming that the plugin files are identical to official releases, key fingerprints remain unchanged, and cryptographic processes are sound. Furthermore, logs show no unauthorized administrator or plugin uploads.
The uploaded plugin functions as a backdoor, hooking into WordPress early in the request cycle. It actively monitors for a specific, secret URL parameter containing a 32-character token. If this token is present, the backdoor creates a new user account with the 'Editor' role and hardcoded password. It then elevates this account's privileges to include manage_options and install_plugins, granting it extensive control. The attacker can then log in directly via a persistent cookie, bypassing standard login procedures, two-factor authentication, and login protection plugins.
Compounding the issue, the created backdoor account persists even after the malicious plugin is removed. The attacker retains knowledge of the account's password. While some analyzed samples contained a coding error that caused a fatal error before the token check, preventing activation, this error itself is what alerted some victims. Attempting to fix this error would inadvertently enable the backdoor. The recommended mitigation is to remove the malicious plugin entirely, rather than attempt to repair it.
This incident follows a previous security event in June 2026, where a vulnerability (CVE-2026-10795) in an outdated, unsigned message format allowed attackers to forge UpdraftCentral commands without needing any keys. Although that vulnerability was patched, exploitation attempts continue. This new key compromise attack vector presents a separate, but equally severe, threat to users who have not yet deleted their UpdraftCentral keys.
As of October 19, 2026, the campaign is actively ongoing, and no vendor fix has been released. The primary mitigation advised by security researchers is to delete all UpdraftCentral keys associated with affected WordPress sites. Patchstack has deployed mitigation rules to block UpdraftCentral remote commands and protect its users.