UpdraftCentral Vulnerability Leads to Unauthorized Plugin Injections
WordPress administrators are urged to audit installations for the malicious Image Core plugin, which is being injected via a remote-control vulnerability in the UpdraftCentral library.
WordPress admins need to audit installations immediately after reports of unauthorized plugin injections tied to the UpdraftCentral remote management library. A malicious plugin named "Image Core" installs without user consent via the UpdraftPlus remote-control interface. This happens even on sites running version 1.26.8, which previously addressed similar security concerns.
Attributed to "StoneDock Tools" at wp-content/plugins/image-core/, the backdoor hooks into the WordPress init function to watch for specific URL parameters. When triggered, it creates a "Site Tools" user account using [email protected]. It assigns this account the Editor role alongside elevated manage_options and install_plugins capabilities. Undefined constants in the malicious code sometimes trigger fatal site errors, rendering sites inaccessible and exposing the attack.
Log analysis points to class-udrpc.php in the UpdraftCentral library. Requests with specific query strings show a vulnerability in the remote-control mechanism enabling unauthorized execution. It remains under investigation whether an access key is compromised or if a protocol bypass exists. Requests stem from masking services like Cloudflare WARP, which complicates IP attribution.
Check logs. Look for class-udrpc.php in user agents or the trigger string _6212fc in URLs. Delete the "Image Core" plugin and "Site Tools" user account immediately. Rotate security keys, including salts, API keys, and application passwords. Remove unused remote-control keys in UpdraftCentral settings.