Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites

Unknown threat actors breached TeamUpdraft's website and gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. These stolen keys were subsequently used to plant backdoors on WordPress sites managed through these services. TeamUpdraft is the developer of UpdraftPlus, a widely-used WordPress backup plugin with over four million active installations. The attack represents a supply chain compromise targeting the management infrastructure rather than the plugin itself. Affected products include UpdraftCentral, UpdraftVault, and UpdraftClone. The breach allowed attackers to leverage legitimate credentials to gain persistent access to customer WordPress installations. The incident highlights risks associated with centralized management platforms for widely-deployed CMS plugins.