UpdraftPlus Security Incident – Backdoor Installed Without UpdraftCentral?

Hello,

I’m investigating a possible connection between the recent UpdraftPlus/UpdraftCentral security incident in October 2026 and two compromised WordPress installations.

Both websites were affected by almost identical malicious plugins, despite being completely independent of each other. One installation uses UpdraftPlus Premium and may have used UpdraftCentral in the past. The other has always used UpdraftPlus Free and has never knowingly been connected to UpdraftCentral.

I would appreciate some clarification, especially regarding the second installation.

1. Two completely independent WordPress installations

The websites have no connection to each other:

• Different hosting providers and servers
• Different WordPress installations and themes
• Different administrators, users and credentials
• No shared FTP/SFTP access
• No centralized WordPress management or agency tools
• Different installed plugins, except for UpdraftPlus

After comparing the plugin directories of both installations, UpdraftPlus was the only plugin they had in common.

2. Malicious plugins discovered

I found the following unauthorized plugins:

• Installation 1: content-core-9bf
• Installation 2: list-engine-505

Despite the different names, both contained the same type of malicious PHP code.

The plugins disguised themselves as legitimate WordPress maintenance utilities. One used the following description:

Small maintenance toolkit: keeps option storage tidy.

The code included functionality to:

• Create a predefined WordPress user with the Editor role
• Grant additional capabilities such as manage_options and install_plugins
• Authenticate the newly created user automatically
• Set WordPress authentication cookies using wp_set_auth_cookie()
• Redirect the attacker directly to the WordPress dashboard

The authentication mechanism was triggered through a predefined URL parameter and token.

Interestingly, the examined backdoor code was defective. It referenced undefined PHP class constants such as self::FIELD and self::TOKEN, resulting in a PHP fatal error.

On the investigated installation, the predefined malicious user did not exist. However, the WordPress database contained an option that would have been created by the malicious plugin’s activation hook.

This suggests that the malicious plugin had been activated, even though its intended authentication mechanism apparently could not execute successfully in the examined version.

Both malicious plugins have since been removed.

3. Installation 1 – UpdraftPlus Premium

This installation has an associated UpdraftPlus Premium account and may have been connected to UpdraftCentral previously.

While investigating the WordPress database, I found an UpdraftCentral log option containing several suspicious entries.

The most important one was:

Time: 1792386431
Level: info
Message: Command received: plugin.upload_plugin
Remote IP: 43.250.53.42
User-Agent: WordPress/6.4; class-udrpc.php
Key indicator: 0.central.updraftplus.com

This entry is from October 19, 2026.

Another entry from the same IP address shortly before that contained:

Message was received, but not understood by local site
Remote IP: 43.250.53.42
User-Agent: WordPress/6.4; class-udrpc.php

The plugin.upload_plugin entry is particularly concerning because it indicates that the installation received a remote command to upload a plugin.

I understand that this does not necessarily prove the upload completed successfully or that it installed the specific malicious plugin.

In addition, the web server access logs contained multiple requests on October 28, 2026, using the same type of User-Agent:

WordPress/6.4; class-udrpc.php

These requests occurred in two groups, around 09:34 and 18:22, and returned HTTP 500 and 301 responses.

The HTTP 500 responses may be related to the fatal error caused by the defective malicious plugin, although I cannot confirm that connection.

Based on these findings, the first installation appears consistent with the recently reported UpdraftCentral security incident.

4. Installation 2 – UpdraftPlus Free, without UpdraftCentral

This is the part I find particularly concerning.

The second website:

• Has always used UpdraftPlus Free
• Has never knowingly been connected to UpdraftCentral
• Has no known UpdraftPlus Premium account associated with it
• Has no UpdraftCentral log option in the WordPress database
• Is hosted on a completely separate server
• Has no shared WordPress administrators, passwords or management tools with the first website

Nevertheless, this installation contained the malicious plugin list-engine-505, with essentially the same backdoor functionality as the plugin discovered on the first website.

I also checked the mu-plugins directories and did not find any suspicious files there.

Unfortunately, I cannot reliably determine when the malicious plugins were originally installed or which UpdraftPlus versions were running at that time.

5. Why I suspect a possible connection

I am aware of the reported October 2026 security incident involving UpdraftCentral connections and unauthorized plugin installations.

The first website seems to match that attack pattern quite closely, particularly because of the recorded plugin.upload_plugin command.

However, the second website does not appear to fit the described scenario.

What makes this unusual is the combination of several findings:

• Two completely independent WordPress installations
• Identical or nearly identical backdoor functionality
• Different, seemingly randomly generated malicious plugin names
• No shared hosting infrastructure, credentials or management software
• UpdraftPlus as the only common plugin
• One installation with a documented UpdraftCentral upload command
• Another installation using only UpdraftPlus Free, without any known UpdraftCentral connection

I realize that identical malware does not necessarily mean that both sites were compromised through the same vulnerability.

However, given these similarities, I would like to understand whether the second infection could still be related to the same attack campaign.

6. Questions

I would appreciate clarification on the following points:

1. Could UpdraftPlus Free installations that were never connected to UpdraftCentral have been affected by the October 2026 security incident?
2. Does UpdraftPlus Free include any UpdraftCentral communication functionality that could potentially be exploited without an existing connection or previously configured connection key?
3. Is it possible for an unauthorized UpdraftCentral connection or key to have existed without the website administrator explicitly configuring it?
4. Have you received similar reports of malicious plugins with different randomly generated names but identical backdoor code?
5. Does the logged Command received: plugin.upload_plugin indicate that the command passed authentication checks, or could this entry also appear for an unauthorized or ultimately rejected request?
6. Are there additional WordPress database options or UpdraftPlus logs that could help determine whether the second website was ever connected to UpdraftCentral?
7. Is there any other known attack vector involving UpdraftPlus that might explain this situation?

7. Current status

Both malicious plugins have been removed, and I am continuing to investigate the affected installations.

So far, I have not found evidence that the malicious user creation mechanism actually worked in the examined code.

I can provide sanitized UpdraftCentral logs, additional technical information and the malicious PHP samples if they would be useful for the investigation.

I am not claiming that UpdraftPlus is conclusively responsible for both compromises. However, the available evidence strongly suggests a connection to the known incident on the first installation, while the second installation remains unexplained.

I would particularly appreciate an explanation of whether a site running UpdraftPlus Free without any known UpdraftCentral connection could have been affected by the same attack.

Thank you for looking into this.