Stolen UpdraftCentral keys used to backdoor WordPress sites

TeamUpdraft, the developer behind popular backup and security plugins for WordPress, has reported a security breach affecting its platform. The incident involves the unauthorized access of its systems, which may have led to the compromise of UpdraftCentral connection keys.

UpdraftCentral serves as a dashboard that allows users to manage multiple WordPress sites from a single interface. The security of this system relies on connection keys, which enable the administrator to send commands, perform updates, and manage configurations across connected sites. The breach raises concerns that threat actors could exploit these stolen keys to inject backdoors or execute arbitrary commands on websites managed through the service.

While the full scope of the compromise is currently being assessed, users of the UpdraftCentral platform are advised to remain vigilant regarding their site integrity and to follow official security guidance provided by the developer.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/