TeamUpdraft Credential Breach Exposes Connected WordPress Sites to Backdoors

The main risk from TeamUpdraft’s security breach is persistence. Attackers used exposed UpdraftCentral connection keys to install malicious plugins and create ways back into connected WordPress sites. Revoking those keys can close the remote access route, but it won’t undo changes already made on a site. The distinction matters: fixing the account or service that enabled access doesn’t, by itself, establish that each connected site is clean.

TeamUpdraft, developer of the UpdraftPlus backup plugin and related management services, said attackers gained unauthorized access to its website and likely accessed its customer database. The exposed information included connection keys for UpdraftCentral, which lets administrators manage multiple WordPress sites remotely. Those keys turn a compromise at the service level into a possible site-level problem, because they can grant a route to systems administrators manage from one place.

UpdraftPlus itself and its downloads weren’t compromised, TeamUpdraft said in a blog post. The company also said backups in customers’ own remote storage, including Google Drive, Dropbox and Amazon S3, weren’t affected. That limits the scope of what the company says was exposed, but it doesn’t answer whether an attacker who reached a WordPress site could have changed its settings or added persistence there. TeamUpdraft advised customers whose sites were accessed through UpdraftCentral to re-authorize remote storage and change related access keys.

TeamUpdraft says it closed the access route and released UpdraftPlus versions 1.26.13 and 2.26.13 for free and Premium users, respectively. These updates revoke older UpdraftCentral Cloud connections. The exposure affects sites connected to UpdraftCentral with an active key; UpdraftPlus had more than four million active installations in October, but that figure doesn’t mean every installation was exposed. The relevant question for an administrator is whether a site was connected through the affected service with a key that remained active during the incident.

Backdoors can outlast revoked keys

WordPress security firm Patchstack reported that attackers used the stolen credentials to run commands on connected sites. Its researchers observed attacks beginning October 18 and identified at least 99 variants of malicious plugins. Some were disguised as maintenance or optimization tools, a choice that could make them less conspicuous to someone scanning a site’s plugin list for obviously suspicious names.

The plugins could create administrator accounts or let attackers authenticate as existing administrators. Some variants were designed to hide from WordPress’s standard administrator screens. That means a routine visual check may not be enough to find every trace; site owners may need to inspect accounts, plugin files, logs and other records with appropriate tools. Nethemba, a web application security firm, said attackers targeted three of its WordPress sites through UpdraftCentral and installed malicious plugins on two.

This is more significant than it looks: revoking a credential stops that credential from opening the door again, but it doesn’t remove a second route an attacker may already have created. Administrators need to check each connected site for unfamiliar plugins, administrator accounts and active sessions. They should also review logs for suspicious activity, change administrator passwords, and delete any remaining UpdraftCentral connection keys. If you’re responsible for several sites, the work has to be done site by site; a central service update can’t verify each installation’s state.

What affected administrators should check

TeamUpdraft says it signed out customer accounts, reset login security, replaced UpdraftVault and UpdraftClone credentials, and added monitoring. Those steps address access to the company’s services and its ability to detect further activity, while the update revokes older cloud connections. The company also reported the incident to the UK Information Commissioner’s Office and other relevant authorities.

The customer databases that may have been accessed contained names, email and billing addresses, order histories, password hashes, two-factor authentication settings and service connection keys. “We do not store any card details. All card payments are handled by Stripe and PayPal,” the company said. Password hashes aren’t the same as plain-text passwords, but their exposure still supports a cautious response, particularly for customers who reused credentials across services.

Administrators should update to the safer UpdraftPlus versions and inspect every site managed through UpdraftCentral Cloud. TeamUpdraft also recommends changing account passwords and resetting two-factor authentication where applicable. If a site shows signs of compromise, the company says it may need to be restored from a verified backup made before October 17, then have its credentials rotated and its integrity checked. A restore is only useful if the backup is known to predate the intrusion and the restored site is checked before it resumes normal operation.

The longer lesson for managed WordPress sites

Centralized management saves administrators time, but it also concentrates access: a key tied to a management service can affect more than one site. Similar systems typically depend on both service-level controls and local checks, because revoking central access cannot establish what happened on every connected endpoint. And this is the part most people overlook: recovery is a verification task as much as a password reset.

Here’s the thing: TeamUpdraft’s statements that the plugin downloads and customer backup storage weren’t affected are useful boundaries, but they don’t settle the status of sites reached through UpdraftCentral. The practical takeaway is that connection-key revocation closes one path in, while site-level checks address what attackers may have left behind. That takes time.