Stolen TeamUpdraft Keys Used to Backdoor WordPress Sites
Summary
TeamUpdraft says an attacker accessed its website and may have reached its customer database. Patchstack reports stolen UpdraftCentral keys are being used to install backdoors on connected WordPress sites.
Key points
- TeamUpdraft detected unauthorized access to its website over October 17–18, contained the access route, signed out accounts, and replaced potentially affected keys and credentials.
- The company believes the attacker accessed customer and billing details, order history, password hashes, two-factor authentication settings, and service connection keys; it says payment details were not stored.
- Patchstack reports attackers began using stolen keys on October 18 to run code and create administrator accounts. It logged at least 99 malicious plugins disguised as maintenance or optimization tools.
- Nethemba says three of its WordPress sites were targeted through UpdraftCentral, with malicious plugins installed on two. It says the attacker used valid dashboard keys, not a server intrusion or configuration flaw.
- TeamUpdraft says UpdraftPlus plugin files and downloads, customer-hosted backups, and self-hosted UpdraftCentral instances were unaffected.
- Users should update UpdraftPlus to version 1.26.13 (free) or 2.26.13 (Premium), or later, then remove UpdraftCentral connection keys from each WordPress site and inspect for indicators of compromise.
- If a site is confirmed compromised, the article recommends restoring from a clean backup, changing the TeamUpdraft password, revoking sessions, and resetting two-factor authentication.
Article Details
- Victim Organization
- TeamUpdraft
- Victim Domain
- teamupdraft.com
- Incident Type
- Unauthorized access to TeamUpdraft's website and customer database, followed by use of stolen UpdraftCentral connection keys to install backdoors on connected WordPress sites.
- Incident Date
- 2026-10-17
- Disclosure Date
- 2026-10-19
- Data Types Exposed
- Customer and billing details
- Order history
- Password hashes
- Two-factor authentication settings
- UpdraftCentral, UpdraftVault, and UpdraftClone connection keys
- Affected Records
- Not disclosed
- Affected Data Size
- An estimated 400,000 websites may have been exposed to attacks; the number of affected customer records is not disclosed.
- Operational Impact
- Stolen keys were reportedly used to execute arbitrary code and install malicious backdoor plugins on connected WordPress sites. Nethemba reported successful plugin installation on two of its three targeted sites. UpdraftPlus plugin files and downloads, self-hosted UpdraftCentral instances, and customers' remote-storage backups were reported as unaffected.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsThe attacker reportedly used valid UpdraftCentral dashboard keys to access connected sites.T1136.001 · Local AccountThe attacks reportedly added accounts with full administrator privileges.T1505.003 · Web ShellMalicious backdoor plugins were installed on targeted WordPress sites.
CVE
People
Vendors
Products
UpdraftCentralStolen UpdraftCentral keys used to backdoor WordPress sitesUpdraftCloneUpdraftClone: for creating staging websitesUpdraftPlusUpdraftPlus: website backup and restoration plugin with more than 4 million downloadsUpdraftVaultUpdraftVault: for cloud backup storageWordPressStolen UpdraftCentral keys used to backdoor WordPress sites