One stolen credential can undo every other defence. Attackers holding remote management access are planting backdoors on WordPress sites that use UpdraftPlus, and even fully updated installations are exposed. Plugins trusted by millions carry security risks too, some rated close to the maximum. Our blog walks you through spotting a breach and recovering from it.

#1 – UpdraftCentral Keys Used to Backdoor WordPress Site

Attackers are using stolen UpdraftCentral keys to install backdoors on WordPress sites running UpdraftPlus (9.8/10 severity). This isn’t a bug in UpdraftPlus, so no plugin update stops it, and even the latest versions are affected. Your site may hold a key even if you never used UpdraftCentral, because connecting a TeamUpdraft.com account creates one by default. The backdoor adds a hidden account that looks like an Editor but can install plugins and skips two-factor login entirely.

Editor Comment
In WordPress, go to Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral, open “Manage existing keys” and delete every key. Removing the site from the UpdraftCentral dashboard isn’t enough. Your backups will keep working. If you spot an unfamiliar plugin or user account, treat the site as compromised and restore from a clean backup.

More Info →

These plugins should be at the top of your security checklist. Review their status and update them as soon as possible.

Rank Math SEO Pro Plugin
Backdoor; 9.8/10; Update to v3.0.124+

Fluent CRM Plugin
Privilege Escalation; 9.8/10; Update to v3.2.6+; Recurring 3×

LearnPress Plugin
Deserialization of untrusted data; 9.8/10; Update to v4.4.11+; Recurring 28×

Amelia Plugin
SQL Injection; 9.3/10; Update to v2.4.11+; Recurring 26×

Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

Their extensive use across the WordPress ecosystem makes timely updates especially important. Verify that your installations are up to date.

Tutor LMS Plugin
Broken Access Control; 7.5/10; Update to v4.1.1+; Recurring 41×

GoSMTP Pro Plugin
XSS; 7.1/10; Update to v1.2.4+

Hide My WP Ghost Plugin
XSS; 7.1/10; Update to v7.0.13+; Recurring 6×

Ultra Addons for Contact Form 7 Plugin
XSS; 7.1/10; Update to v3.5.55+; Recurring 7×

Download Monitor Plugin
XSS; 6.5/10; Update to v5.3.4+; Recurring 10×

The Events Calendar Plugin
XSS; 6.5/10; Update to v6.18.2+; Recurring 32×

Smush Image Compression and Optimization Plugin
Settings Change; 2.7/10; Update to v4.3.4+; Recurring 2×

Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

Fewer installations, potentially serious consequences. Check whether your sites are affected and update these plugins to the latest available versions.

The Grid Plugin
RCE; 10/10; Update to v2.8.2+; Recurring 4×

10Web Booster Plugin
Arbitrary File Upload; 9.8/10; Update to v2.34.11+; Recurring 6×

Theme My Login Plugin
Privilege Escalation; 9.8/10; Update to v7.2.2+; Recurring 4×

My Calendar Plugin
PHP Object Injection; 9.8/10; Update to v3.8.8+; Recurring 6×

Abandoned Cart Pro for WooCommerce Plugin
IDOR; 9.8/10; Update to v10.8.1+; Recurring 4×

MailOptin Plugin
Privilege Escalation; 9.8/10; Update to v1.2.78.7+; Recurring 3×

Mang Board WP Plugin
Arbitrary File Upload; 9.8/10; Update to v2.4.5+; Recurring 10×

Link Whisper Free Plugin
PHP Object Injection; 9.3/10; Update to v0.9.8+; Recurring 6×

Green Popups Plugin
SQL Injection; 9.3/10; Update to v7.6.3+

Editor Comment
It’s worth taking a few minutes each week to perform a sites review to catch issues early and wherever possible, use ShieldPRO’s auto-upgrade feature for vulnerable plugins.

#5 – Our blog: Hacked? How to Spot It and Recover

Backdoor accounts rarely announce themselves. Learn the warning signs of a hacked WordPress site and follow our five-step plan to get it back safely.

More Info →

Thanks for reading, and have a wonderful week!

Paul Goodchild
Shield Security for WordPress