TeamUpdraft, the company behind the UpdraftPlus backup plugin, says someone broke into its teamupdraft.com website over the weekend of 17-18 October and likely reached its customer database. That database held names, billing details, order history, password hashes, two-factor settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. UpdraftCentral is the vendor’s cloud service for managing many WordPress sites from one dashboard, and its keys can send commands to the sites they are connected to. TeamUpdraft says it stores no card details and that the UpdraftPlus plugin files and downloads were not affected.
Attackers are already using those keys. Patchstack reports that the campaign began on 18 October at 15:32 UTC and ran continuously for about 18 hours, using validly signed UpdraftCentral commands to run code and add administrator accounts. It logged at least 99 backdoor plugins under different names, disguised as WordPress maintenance tools (BleepingComputer cites “Site Health Cache” as one). Patchstack stresses this is not a code flaw in UpdraftPlus and has no CVE: the plugin sees a correctly signed instruction and obeys it. BleepingComputer, citing an estimate, says about 10% of UpdraftPlus sites have an UpdraftCentral or Migrator key, which could expose around 400,000 websites. Security firm Nethemba, which found the campaign on its own sites, says the attacks continued after TeamUpdraft had closed the attacker’s access, because stolen keys keep working until each site deletes them.
How to check if you’re affected
Affected products are WordPress sites running UpdraftPlus (free or Premium) that hold an UpdraftCentral connection key. Self-hosted UpdraftCentral is not affected, per TeamUpdraft. Nethemba warns you may have a key without ever having used UpdraftCentral: signing in to a teamupdraft.com account from inside UpdraftPlus ticks “Add this website to UpdraftCentral” by default, so check every site that runs the plugin.
- Update first, with the right version. Nethemba found that UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium) were meant to remove old keys but, because of a bug, deleted none. Update to 1.26.13 / 2.26.13 or later. TeamUpdraft says that release disconnects every UpdraftCentral connection made before 22:00 BST on 18 October; Nethemba says keys created on 18 October between 12:07 and 21:00 UTC survive it, so delete those by hand.
- Delete the key on each site. In the site’s own WordPress dashboard (not through UpdraftCentral), go to Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral and remove the connection key.
- Look for the backdoor. Check Users for administrator accounts you don’t recognise and Plugins, including the Must-Use tab, for anything unfamiliar. Nethemba reports that “Site Health Cache” hides itself from the admin plugin list, so also use the checking script and indicators published by Nethemba and Patchstack.
- If you find something, TeamUpdraft suggests restoring from a backup taken before 17 October and changing all administrator passwords. Also change your teamupdraft.com password and reset two-factor authentication there; if a site was accessed through UpdraftCentral, TeamUpdraft also advises re-authorising its remote backup storage and changing the storage access keys as a precaution.
- Free UpdraftPlus users with no teamupdraft.com account need no account action, per TeamUpdraft, though the key check above still applies.