Stolen UpdraftCentral keys used to backdoor WordPress sites
Original title: Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
TeamUpdraft says its site was breached on October 17-18, and attackers installed backdoor plugins for about 18 hours.
Unknown attackers accessed teamupdraft.com over October 17-18 and may have obtained customer connection keys for UpdraftCentral, UpdraftVault and UpdraftClone, plus names, emails, billing data, hashed passwords and 2FA settings. Patchstack and Nethemba say valid keys were then used on October 18-19 to upload backdoor plugins that create privileged WordPress users. TeamUpdraft reset keys, notified the UK ICO, and released UpdraftPlus builds that drop connections made before 10 p.m. BST on October 18. The vendor said the UpdraftPlus plugin code and customer-owned backups were not affected.
Unconfirmed: TeamUpdraft says the keys were potentially accessed; it does not list which customer sites were backdoored.
- Payment data was not in the database; Stripe and PayPal handle it.
- The backdoor looks for "?_9f5696=" and can create user "data-ops43".
- That account can receive manage_options and install_plugins rights.
- A broken early plugin caused HTTP 500 errors before a working upload.
- UpdraftPlus 1.26.13 and 2.26.13 disconnect pre-incident UpdraftCentral keys.
Impact: customer account data and keys exposed; backdoors on connected sites
| Product | Affected | Fixed in |
|---|---|---|
| TeamUpdraft UpdraftPlus | — | 1.26.13 (free), 2.26.13 (Premium) |
- 1.Change teamupdraft.com passwords, reset 2FA, and treat unexpected TeamUpdraft email cautiously.
- 2.Update UpdraftPlus to 1.26.12 or 2.26.12 or later, delete the UpdraftCentral key, and remove unknown admins and plugins.
- 3.Reconnect UpdraftVault and replace UpdraftClone client keys.
- Vendors
- TeamUpdraft
- Victims
- TeamUpdraft
- Organizations
- PatchstackNethembaInformation Commissioner's Office
- Countries
- United Kingdom
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | rank1cdn.com | e malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose Wor |
| ipv4 | 43.250.53.42 | b Tech, System Staff, System Ops, or Cms Tech IP addresses: 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9 In all, Patchstack said it o |
From the original article
6 min read at thehackernews.com
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.