Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites After TeamUpdraft Breach
Attackers exploited stolen connection keys from the TeamUpdraft breach to inject backdoors into managed WordPress websites.
Key points
- TeamUpdraft detected unauthorized access to its infrastructure over the weekend of October 17-18.
- Researchers confirm attackers are using stolen UpdraftCentral keys to execute arbitrary code and create admin accounts.
- Approximately 400,000 websites may be exposed if they use UpdraftCentral or Migrator keys.
A threat actor breached TeamUpdraft’s infrastructure, compromising connection keys that allow remote command execution on connected WordPress sites, according to security researchers. The developer of the popular backup plugin detected the intrusion over the weekend of October 17 and 18, triggering an immediate containment response.
TeamUpdraft stated that the unauthorized access targeted its customer database, which held billing details, order history, and sensitive service keys. The company confirmed that payment information was not stored on the compromised servers. However, the exposure includes UpdraftCentral, UpdraftVault, and UpdraftClone connection keys, which grant remote management capabilities to the attacker.
Context and Background
Following the breach, security firm Patchstack reported that attackers began exploiting the stolen credentials to install malicious software. Lead researcher Oliver Sild noted that the campaign started on October 18 at 15:32 UTC. The attackers used the compromised keys to execute arbitrary code on connected websites, effectively turning the remote management feature into a vector for compromise.
Patchstack researchers identified at least 99 distinct malicious backdoor plugins installed during this campaign. These files were disguised as legitimate maintenance and optimization tools, with names such as “Site Health Cache.” The researchers warned that this activity could be more severe than the previously reported “wp2shell” attack, given the direct administrative access obtained.
Who Is Affected
The impact primarily concerns users of UpdraftCentral, the remote management service for multiple sites. TeamUpdraft estimates that about 10% of sites using the UpdraftPlus backup plugin have an active UpdraftCentral or Migrator key. This calculation suggests that approximately 400,000 websites could be exposed to the attack vector.
TeamUpdraft clarified that the UpdraftPlus plugin files and downloads themselves remain unaffected. Furthermore, self-hosted instances of UpdraftCentral are not impacted by this specific breach of the central server. The vendor noted that backups in customers' own remote storage are unaffected, recommending users rotate credentials if they accessed sites via UpdraftCentral.
What should you do?
TeamUpdraft responded to the incident by closing the access route, signing out all accounts, and replacing potentially affected keys and credentials. The company advises users to rotate their remote storage credentials and reauthorize connections if they manage sites through UpdraftCentral. This step is necessary to ensure that the old, potentially compromised keys are no longer valid for accessing the website.
What to do and how to stay safe: TeamUpdraft
- Check if your website uses UpdraftCentral or UpdraftClone for remote management and review active connection keys.
- Rotate all storage credentials associated with your backup plugin to invalidate any potentially stolen access tokens.
- Scan your WordPress installation for unknown plugins, particularly those disguised as maintenance tools or cache managers.
- Monitor user accounts for any newly created administrators that you did not explicitly add.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the attacker steal credit card or payment information?
TeamUpdraft stated that it does not store any payment details, so financial information was not compromised in this breach.
Are self-hosted UpdraftCentral instances affected?
No, the vendor confirmed that self-hosted UpdraftCentral instances are not impacted by this server-side breach.
What kind of malicious software was installed?
Attackers installed at least 99 distinct backdoor plugins disguised as legitimate maintenance and optimization tools like cache cleaners.
