Overview
- TeamUpdraft detected unauthorized access to its website over the weekend of October 17–18 and says the attacker likely accessed its customer database, including password hashes, two‑factor settings, and connection keys for UpdraftCentral and related services.
- Researchers observed attackers beginning on October 18 using stolen UpdraftCentral keys to execute commands and install backdoor plugins on managed WordPress sites without exploiting any site vulnerability.
- Patchstack logged at least 99 distinct malicious plugin names that were disguised as maintenance tools and Nethemba confirmed two of three tested sites were successfully backdoored and had unauthorized administrator access created.
- TeamUpdraft released corrected updates (UpdraftPlus 1.26.13 and 2.26.13) that revoke cloud connection keys after an earlier release failed to remove them and the company says it closed the access route and rotated affected credentials.
- Site owners are urged to update UpdraftPlus, manually revoke or delete UpdraftCentral connection keys on each site, inspect logs and files for indicators of compromise, restore from clean backups if compromised, and change account credentials and 2FA methods.