Stolen UpdraftCentral keys used to backdoor WordPress sites
Signed commands installed backdoor plugins from October 18 to 19; no plugin update stops it, so sites must delete UpdraftCentral keys.
2
Stories per day · 30 days
Relatedwordpress2backdoor1duplicator1key-compromise1php-object-injection1updraftcentral1updraftplus1
2 stories, newest first · one card per story
Stories tagged #site-takeover
Duplicator has unauthenticated PHP object injection (CVE-2026-82814)
Builds through 1.5.17 and Pro 4.6.10 are fixed in 5.0.0; old packages keep the installer that created them.
1