Stolen TeamUpdraft keys used to backdoor connected WordPress sites
Original title: WordPress sites compromised after TeamUpdraft credential exposure
Patchstack saw attacks from October 18 using UpdraftCentral keys to install at least 99 malicious plugin variants and create admin accounts.
Attackers used connection keys exposed after unauthorized access to TeamUpdraft’s website to run commands on WordPress sites linked through UpdraftCentral and install malicious plugins. TeamUpdraft says the customer database was likely accessed and that UpdraftPlus downloads and customer-held backups were not compromised. It released UpdraftPlus 1.26.13 and 2.26.13 to revoke older UpdraftCentral Cloud connections, but revoking a key does not remove plugins, accounts, or sessions already created.
Unconfirmed: TeamUpdraft says its customer database was likely accessed, not that access is fully confirmed.
- Only sites with an active UpdraftCentral key are exposed; UpdraftPlus has over four million active installs.
- Exposed data includes names, emails, billing addresses, order histories, password hashes, 2FA settings, and connection keys.
- Nethemba said three of its sites were targeted and malicious plugins were installed on two.
- TeamUpdraft notified the UK Information Commissioner’s Office and reset related service credentials.
- Compromised sites may need a verified backup from before October 17.
Impact: Remote commands, malicious plugins, and new administrator accounts
| Product | Affected | Fixed in |
|---|---|---|
| TeamUpdraft UpdraftPlus | — | 1.26.13 free; 2.26.13 Premium |
- 1.Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) to revoke old UpdraftCentral Cloud connections.
- 2.Delete leftover connection keys, review plugins and admin accounts, and change administrator passwords.
- 3.If compromised, restore a verified backup from before October 17 and rotate storage and account credentials.
- Vendors
- TeamUpdraft
- Products
- UpdraftPlusUpdraftCentral
- Victims
- Nethemba
- Organizations
- PatchstackInformation Commissioner's Office
From the original article
2 min read at csoonline.com
Attackers are using stolen connection keys exposed in a TeamUpdraft security breach to install malicious plugins on affected WordPress sites and establish persistent access. Sites already compromised may remain at risk even after the exposed credentials are revoked. The attacks followed unauthorized access to TeamUpdraft’s website.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.