Stolen UpdraftCentral Keys Compromise Over 100 WordPress Sites

• •Over 100 WordPress sites compromised due to stolen UpdraftCentral keys.
• •Attacker installs backdoor plugins using legitimate commands, bypassing security checks.
• •Immediate action required: delete UpdraftCentral keys to mitigate the threat.

An attacker has exploited stolen UpdraftCentral dashboard keys to install backdoor plugins on connected WordPress sites. The campaign, confirmed by TeamUpdraft, began on October 18 and has affected over 100 sites, with attacks still ongoing. The commands sent by the attacker are encrypted and signed with legitimate keys, bypassing security checks in the UpdraftPlus plugin. The only mitigation currently available for site owners is to delete their UpdraftCentral keys. TeamUpdraft has acknowledged the breach and is working on an emergency update to disconnect compromised keys. The incident has been rated 9.8 on the CVSS scale by Patchstack, but no CVE has been issued as the plugin itself is not vulnerable. Nethemba, a Slovak security firm, first detected the campaign on their infrastructure. The breach does not expose payment details, but other sensitive customer data was accessed.