Attackers successfully installed malicious software on multiple WordPress websites after stealing remote access credentials from TeamUpdraft, the company behind the widely used UpdraftPlus backup plugin, according to a security report published by CSO Online. The breach exposed connection keys for UpdraftCentral, a service that allows administrators to manage multiple WordPress sites remotely, enabling intruders to execute commands and plant backdoors on affected sites. Security researchers warn that compromised sites may remain vulnerable even after the stolen credentials are canceled, since attackers established persistent access through hidden plugins and administrator accounts.
The unauthorized access to TeamUpdraft's systems likely exposed customer database information, including names, email addresses, billing details, order histories, password hashes, two-factor authentication settings, and service connection keys, the company confirmed. WordPress security firm PatchStack documented attacks starting on October 18, identifying at least 99 different versions of malicious plugins designed to maintain persistent access and generate accounts with administrative privileges. Web application security company Nethemba reported that intruders targeted three of its WordPress installations through the remote-management channel and successfully planted malicious plugins on two of them. Some backdoor variants can create privileged accounts or authenticate as existing administrators, while others are engineered to evade detection in WordPress's standard administrator screens. UpdraftPlus exceeded four million active WordPress installations in October, though only sites connected to UpdraftCentral through an active key face exposure to this specific attack.
TeamUpdraft said it has sealed the access route and released UpdraftPlus versions 1.26.13 and 2.26.13 to revoke older UpdraftCentral Cloud connections. The UpdraftPlus plugin itself and its downloads were not compromised, and backups stored in customers' own remote storage—including Google Drive, Dropbox, and Amazon S3—were also unaffected, according to the company. However, the company advised that "if your site was accessed through UpdraftCentral, please also re-authorise your remote storage and change any storage access keys, as a precaution." The researchers emphasized that revoking the original connection key doesn't automatically remove rogue plugins, accounts, or active sessions created during an attack.
The breach highlights the cascading security risks inherent in centralized management platforms, where a single compromise can unlock access to hundreds or thousands of downstream sites. Administrators using UpdraftCentral Cloud have been advised to update to safer UpdraftPlus versions and inspect each connected site directly, with recommended checks including deleting remaining UpdraftCentral connection keys, reviewing administrator accounts and installed plugins, changing administrator passwords, and examining logs for suspicious activity. Sites showing signs of compromise may need restoration from a verified backup created before October 17, followed by credential rotation and integrity checks. TeamUpdraft has signed out customer accounts, reset login security, replaced UpdraftVault and UpdraftClone credentials, introduced additional monitoring, and reported the incident to the UK Information Commissioner's Office and other relevant authorities. The company clarified it doesn't store card details, as all card payments are handled by Stripe and PayPal, and recommended changing account passwords and resetting two-factor authentication where applicable. The distributed nature of plugin-based ecosystems means trust failures at centralized chokepoints can propagate faster than defenders can respond, turning routine administrative convenience into an operational liability that persists long after the initial breach is contained.