Stolen UpdraftCentral Keys Put Backdoors on Connected WordPress Sites

Since October 18, backdoor plugins have been installed on sites connected to UpdraftCentral, and the cause is not a bug in UpdraftPlus. The attacker had genuine connection keys, and TeamUpdraft believes its customer database, where those keys are stored, was accessed.

UpdraftPlus 1.26.12 revoked keys created before the incident and 1.26.13 fixed how the revocation was applied, so you need 1.26.13 or later. The update was pushed automatically, but it does not remove a backdoor that is already installed. One analysis advises looking for plugins described as “Small maintenance toolkit: keeps option storage tidy” and for Editor users who have been given manage_options and install_plugins, an account missing from the administrator list.