UpdraftPlus & UpdraftCentral: Stolen Remote Management Keys Deploy Stealth Backdoors

Threat Overview

An active supply-chain campaign is compromising WordPress websites running UpdraftPlus, the ecosystem’s most widely installed backup plugin (over 4 million active sites), by abusing legitimate UpdraftCentral remote management signing keys stolen from TeamUpdraft’s cloud infrastructure.

Rated CRITICAL (CVSS 9.8) by Patchstack, this incident is not a coding flaw inside the local plugin. Because the attacker holds genuine dashboard private keys, malicious commands pass every cryptographic check in the latest releases (1.26.11 and 2.26.11.26). Updating the plugin does not stop the attack; operators must manually delete their local UpdraftCentral connection keys.

The Breakdown: How the Exploit Works

Every copy of UpdraftPlus ships with a built-in client for UpdraftCentral, the vendor’s remote management dashboard. Crucially, the plugin’s TeamUpdraft login screen includes a pre-ticked checkbox (“Add this website to UpdraftCentral”), meaning thousands of site owners who only logged in for backups unknowingly enrolled their sites and generated non-expiring RSA trust keys.

Using private keys compromised from UpdraftCentral Cloud, attackers send signed plugin.upload_plugin remote procedure calls to connected sites. WordPress treats the command as a trusted administrator action and installs a disguised backdoor plugin—such as Site Health Cache or dozens of randomized variants—all sharing the description “Small maintenance toolkit: keeps option storage tidy.”

The Operational Risk: What an Attacker Gains

• Plugin Updates Offer Zero Protection: Because commands carry valid signatures, fully updated sites are compromised alongside older versions.
• Disguised Administrator Privilege: Triggered via a 32-character URL token, the backdoor creates a user (data-ops43, media-staff96) under the Editor role to stay hidden from Administrator lists while secretly granting install_plugins and manage_options.
• Complete 2FA & Firewall Bypass: The backdoor sets a persistent authentication cookie directly in the response, bypassing login screens, two-factor authentication, and brute-force limiters.
• Persistent Account Survival: Even if the rogue plugin is removed, the elevated Editor account and _sync_token database option remain active.

Our Take in Plain English

“When you install a backup plugin to protect your business, you do not expect a pre-checked box to enable a remote-control receiver on your server. Because WordPress sites are managed inside their own live web servers, central management tools require permanent cryptographic backdoors into production—and when the vendor’s cloud keys leak, every connected site obeys the attacker. In a modern pre-rendered edge architecture, backups and version history live in an encrypted Git repository detached from the public server, leaving no remote-management listener on production to hijack.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Embeds remote procedure call (RPC) listeners inside production websites that execute arbitrary plugin uploads whenever presented with an external signing key.
• Modern Pre-Rendered Edge Architecture: Maintains full version history and rollbacks inside an isolated code repository, serving static edge assets with zero remote-management endpoints.

Immediate Action Items for WordPress Operators

1. Check for Active Keys: Run wp option get updraft_central_localkeys or check Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral.
2. Delete Local Connection Keys: Run wp option delete updraft_central_localkeys or delete all keys in the plugin panel.
3. Scan for Backdoor Plugins: Search wp-content/plugins/ for "Small maintenance toolkit: keeps option storage tidy." and move matching folders outside the web root.
4. Audit Editor Capabilities: Query wp_usermeta for any Editor holding manage_options or install_plugins, remove _sync_token options, and rotate credentials.