Security vulnerability affecting UpdraftPlus 1.26.11

  • mvwautotechniek

    (@mvwautotechniek)


    18 hours, 20 minutes ago

    I would like to report a potential security vulnerability affecting UpdraftPlus 1.26.11.

    On October 19, 2026, three separate WordPress installations on the same VPS were compromised. All three were running UpdraftPlus 1.26.11, with official plugin checksums successfully verified.

    Our investigation revealed:

    • Three unauthorized plugins (flex-core-858, hero-hub-c9d, boost9pack-401f) containing administrator-access backdoors were installed.
    • All three installations received POST requests from the same IPv6 address, immediately before the malicious plugin files appeared: 2a09:bac5:4e21:2e3c::49b:9..
    • The HTTP User-Agent was WordPress/6.4; class-udrpc.php.
    • The internal UpdraftCentral logs recorded Command received: plugin.upload_plugin for all three installations.
    • A fourth WordPress installation on the same VPS, without UpdraftPlus, showed no evidence of this attack.

    The UpdraftCentral logs strongly suggest that the malicious plugins were uploaded through its RPC interface.

    We have not established whether this involved an authorization bypass, compromised credentials, or another vulnerability.

    Given the similarities to previously reported UpdraftCentral vulnerabilities, I recommend investigating this as a potential security issue affecting version 1.26.11.

    I can provide anonymized logs and malicious plugin samples through a secure reporting channel.

    Kind regards

    • This topic was modified 17 hours, 45 minutes ago by Yui.
    • This topic was modified 17 hours, 31 minutes ago by mvwautotechniek.
Viewing 1 replies (of 1 total)
  • spiwee

    (@spiwee)

    12 hours, 22 minutes ago

    Hello,

    Same issue here: 4 client sites (different hosts), all connected to UpdraftCentral Cloud.

    Besides the broken “keeps option storage tidy” plugins described by Nethemba (https://nethemba.com/updraftcentral-backdoor-analysis/), I found two working backdoors on some sites:

    • site-health-cache: a secret GET parameter logs the visitor in as the first administrator. Some versions hide themselves from the plugin list.
    • compress-suite / src-master-790a / defer-sweep-8-94c7: these can create a hidden administrator (@example.com, ID stored in an option <slug>_uid).

    Procedure I followed (worked out with an AI assistant):

    1. Deleted every plugin dated 18–19 Oct via FTP, and checked mu-plugins/.
    2. Deleted the UpdraftCentral keys on each site and removed the sites from the dashboard.
    3. Checked the database: no <slug>_uid option and no @example.% user, so no hidden account was created. Then removed the leftover options.
    4. Searched the access logs for the secret parameters: nothing found.
    5. Regenerated the wp-config.php salts.
    6. Changed the TeamUpdraft password and enabled 2FA.

    Is this enough? Could the backups have been accessed?

    Thanks.

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.