Stolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft says a weekend breach exposed remote-management keys; Patchstack logged backdoor plugins on connected sites.
TeamUpdraft said unauthorized access to teamupdraft.com on October 17-18 may have exposed its customer database, including password hashes, two-factor settings, and UpdraftCentral, UpdraftVault, and UpdraftClone connection keys. Payment data and UpdraftPlus plugin files were not stored or affected, and self-hosted UpdraftCentral is not impacted. Patchstack says attackers began using stolen keys on October 18 to run code and add administrators, logging at least 99 backdoor plugins. Nethemba says valid dashboard keys installed plugins on two of its sites despite current WordPress and a patched UpdraftPlus.
Unconfirmed: The figure of about 400,000 sites is an estimate that 10% of UpdraftPlus sites hold a relevant key.
- About 10% of UpdraftPlus sites may hold a relevant key, roughly 400,000 sites.
- Releases 1.26.12 and 2.26.12 failed to remove UpdraftCentral Cloud keys.
- Recommended updates are UpdraftPlus 1.26.13 free and 2.26.13 Premium or later.
- Patchstack says the attacks started on October 18 at 15:32 UTC.
Impact: remote commands and administrator accounts on connected sites
| Product | Affected | Fixed in |
|---|---|---|
| TeamUpdraft UpdraftPlus | 1.26.12 and 2.26.12 did not remove Cloud keys | 1.26.13 (free) / 2.26.13 (Premium) or later |
| TeamUpdraft UpdraftCentral | — | — |
- 1.Update UpdraftPlus to 1.26.13 or 2.26.13 or later, then delete UpdraftCentral keys.
- 2.Rotate remote storage credentials and reauthorize connections used through UpdraftCentral.
- 3.If compromise is confirmed, restore from clean backups and reset TeamUpdraft credentials.
- Vendors
- TeamUpdraft
- Victims
- Nethemba
- Organizations
- Patchstack
From the original article
3 min read at bleepingcomputer.com
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.