Security Breach Affects UpdraftPlus Plugin
A significant security breach has struck UpdraftPlus, a widely utilized WordPress backup plugin that is operational on over three million websites.
This incident has permitted cybercriminals to install nefarious plugins and establish unauthorized administrator accounts.
The attack took advantage of compromised UpdraftCentral connection keys, which enabled assailants to seize control of linked WordPress websites without requiring a username or password.
Compromise of Updraft Website
On the weekend of October 17-18, 2026, TeamUpdraft confirmed that its website had been infiltrated. The organization suspects that attackers accessed sensitive customer data, which included connection keys for various services, such as UpdraftCentral. The exploitation of these keys granted the intruders unauthorized access to connected WordPress sites.
Response from Updraft Security Team
In a blog post, TeamUpdraft elucidated that they promptly closed the unauthorized access pathway at the core of the breach, replaced compromised credentials, and deployed security updates that invalidated older UpdraftCentral connections.
The updates, versions UpdraftPlus 1.26.13 for the free edition and 2.26.13 for the premium edition, were rolled out on October 19, 2026.
According to the plugin changelog, these updates rescinded UpdraftCentral Cloud keys, with the recent version 1.26.13 correcting issues regarding the implementation of the revocation from the prior release.
The updates automatically severed affected websites from UpdraftCentral, effectively blocking any further access through these keys.
Moreover, it was reported that WordPress.org has pushed these updates to users automatically.
Overview of UpdraftPlus Backup Plugin
The UpdraftPlus plugin serves as a robust tool for WordPress websites, facilitating backups, restorations, and migrations across different hosting platforms or domains.
It also supports automated backup solutions, allowing website proprietors to store backup copies across popular cloud services like Google Drive, Dropbox, and Amazon S3.
Additionally, the plugin features UpdraftCentral, a remote management capability that enables website owners to oversee multiple WordPress installations from a centralized dashboard—this feature is pivotal in the recent security breach.
The Breach of UpdraftCentral
UpdraftCentral employs security keys to validate commands dispatched from the remote dashboard to affiliated websites. These keys permit the service to execute administrative functions without necessitating a separate login for each website.
Exploiting Compromised Security Keys
The compromised UpdraftCentral keys enabled attackers to transmit commands to connected WordPress websites, which masqueraded as authentic instructions from the remote management interface.
Standard security protocols failed to differentiate between legitimate directives and those authenticated using stolen keys, thereby causing WordPress sites to accept the attackers’ commands as sanctioned.
In an initial analysis published by security firm Patchstack, prior to the release of security updates by TeamUpdraft, the situation was characterized as not an inherent vulnerability:
“This is not a vulnerability in UpdraftPlus, and as of 19 October no plugin update stops it. The commands are correctly encrypted and signed with genuine dashboard private keys. Every check in the plugin passes, because from the site’s point of view the instruction is legitimate.”
This indicates that attackers were not exploiting a coding flaw within UpdraftPlus itself; rather, the security checks functioned as intended, yet the compromised keys allowed the attackers to impersonate the remote management service.
Installation of Malicious Plugins
Once armed with the compromised UpdraftCentral security keys, assailants sent commands to connected WordPress websites, coercing them to install and activate malignant plugins.
As these commands bore the authentication of legitimate security keys, the websites assimilated them as proper instructions, executing the installations through WordPress’s standard plugin procedure.
The insidious plugins harbored a backdoor, enabling the creation of a WordPress user account with the Editor role, subsequently granting that account elevated administrative privileges.
Although an Editor account typically lacks the authority to install plugins or manipulate critical WordPress settings, the malignant code conferred such capabilities, rendering unauthorized accounts challenging to detect, as they could easily masquerade as standard Editors while possessing administrative-like permissions.
Moreover, the backdoor circumvented the traditional WordPress login interface, bypassing security measures such as two-factor authentication and restrictions on login attempts.
Patchstack’s analysis revealed that the malicious plugins contained a coding flaw preventing affected websites from operating correctly, causing server errors prior to the activation of the backdoor. Nevertheless, this flaw did not mitigate the inherent risk presented by the malignant plugins.
Patchstack identified a variety of names attributed to the malicious plugins, totaling 99, including one dubbed Site Health Cache.
The titles generally resembled those of legitimate maintenance and performance utilities, thereby masking them from website proprietors surveilling installed plugins.
Unrecognized Connections for WordPress Sites
A crucial aspect of this security incident is that a website owner may have a functioning UpdraftCentral connection, even if they never intended to engage with the remote management service.
Patchstack reported that linking a website to a TeamUpdraft account could inadvertently establish an UpdraftCentral connection, as the option for remote management was pre-selected by default.
Consequently, websites employing UpdraftPlus solely for backup could harbor active connection keys, unbeknownst to their owners.
This incident impacts sites with active UpdraftCentral Cloud connections, rather than every site with the UpdraftPlus plugin.
Patchstack also verified that the security issue was prevalent across both free and premium versions of UpdraftPlus. TeamUpdraft affirmed that self-hosted UpdraftCentral installations remained unaffected.
Call to Action for UpdraftPlus Users
TeamUpdraft is imploring website owners, even those who have never knowingly utilized UpdraftCentral, to scrutinize their sites for signs of unauthorized activity.
The company advises examining installed plugins for any unfamiliar additions and auditing WordPress user accounts for rogue administrative access.
Website proprietors should also ensure they are employing UpdraftPlus versions 1.26.13 or 2.26.13, or more recent iterations, and eliminate any lingering compromised UpdraftCentral connection keys.
Management of connection keys can be performed via the WordPress dashboard under Settings, UpdraftPlus, Advanced Tools, and UpdraftCentral.
TeamUpdraft further recommends altering administrator passwords and considering restoration from a backup made prior to October 17, should evidence of compromise surface.
Users with TeamUpdraft accounts are also prompted to modify their account passwords.
The company asserts that there is currently no indication that attackers retain access to its systems, although investigations are ongoing.
While the security updates thwart further access through the breached connections, they do not eliminate malicious plugins or the unauthorized accounts that might have already infiltrated affected websites. Consequently, verifying for signs of compromise remains critical, even subsequent to updates.
Source link: Searchenginejournal.com.
