UpdraftCentral key compromise: malicious plugin upload

I’m posting this both to alert the developers and to warn other users, because I experienced what appears to be a compromise through the UpdraftCentral remote-control channel.

I’m currently running UpdraftPlus Free version 1.26.11. I previously used Premium but no longer do.

On October 19, 2026, I discovered an unauthorized plugin installed on my WordPress site:

/wp-content/plugins/site-frame-95a/

The plugin identified itself as:

• Plugin Name: Site Frame 95A
• Description: “Small maintenance toolkit: keeps option storage tidy.”
• Version: 3.2.4
• Author: WP Foundry Co

The plugin was actually a backdoor. Its code contained a hard-coded token, username, and password. If invoked with the correct secret URL parameter, it was designed to create a user named data-build90, grant that user manage_options and install_plugins, authenticate the account, and redirect the attacker into WP Admin.

Fortunately, that user account does not appear to have been created on my site, and I found no other unauthorized elevated users.

What concerns me most is what I found in UpdraftPlus → Advanced Tools → UpdraftCentral → recent log events:

2026-10-19 00:54:42 +0000 [43.250.53.42] [0.central.updraftplus.com] Message was received, but not understood by local site (for: probe.central.updraftplus.com)

2026-10-19 06:18:24 +0000 [43.250.53.42] [0.central.updraftplus.com] Command received: plugin.upload_plugin

The second entry appears to correspond directly to the malicious plugin being uploaded.

My site still had two old UpdraftCentral Remote Control keys, one created in 2019 and another in February 2025. I do not use UpdraftCentral remote management and had forgotten those keys existed. I have now deleted both of them.

I have also:

• removed the malicious plugin
• removed the related option it created
• checked user meta for administrator-level access
• confirmed that data-build90 does not exist
• retained screenshots and copies of the malicious plugin files
• reported the incident directly to TeamUpdraft

I am continuing to use UpdraftPlus for backups only.

Could the developers please clarify:

1. Whether there is a known issue involving compromised or leaked UpdraftCentral keys.
2. Whether old UpdraftCentral keys remain valid indefinitely unless manually deleted.
3. Whether deleting all UpdraftCentral keys is sufficient to prevent further remote-control commands while continuing to use UpdraftPlus normally for backups.
4. Whether there are any other keys, tokens, options, or credentials affected users should revoke.
5. Whether there are additional indicators of compromise users should check for.

I’d also encourage anyone using UpdraftPlus to check:

UpdraftPlus → Advanced Tools → UpdraftCentral

and review both the active remote-control keys and the recent UpdraftCentral log events, especially if they do not actively use UpdraftCentral.

I’m happy to provide the malicious plugin files and screenshots of the log to the developers if useful.