A WordPress site can look healthy while an intruder keeps the keys to it. That is the situation facing administrators who manage installations through UpdraftCentral Cloud after a break-in at TeamUpdraft, the company behind the UpdraftPlus backup plugin.
Attackers took connection keys from the vendor’s customer database and used them to push plugins onto sites tied to that channel. Patchstack traced hostile activity to October 18 and has catalogued no fewer than 99 plugin variants deployed this way. TeamUpdraft said its own plugin files and downloads escaped tampering, as did backups sitting in customer-owned storage such as Google Drive, Dropbox and Amazon S3.
The exposed records
Vendor databases were probably reached. Contact details, order histories, password hashes, two-factor settings and the connection keys all sat inside them. No card numbers were held; Stripe and PayPal process those payments.
Why cleanup takes longer
UpdraftPlus releases 1.26.13 and 2.26.13 sever the older UpdraftCentral links, and TeamUpdraft has logged customers out, hardened sign-in security and replaced Vault, Clone and monitoring arrangements. None of that removes code already planted. A revoked key leaves rogue plugins, fresh administrator logins and open sessions in place. Backdoors of one shape mint privileged accounts; other shapes sign in as an existing administrator, or hide from the standard admin screens. Web application security firm Nethemba found attackers reached three of its WordPress sites this way, altering two.
What administrators should do
Patch UpdraftPlus first, then clear every leftover UpdraftCentral key. Review administrator rights and installed plugins, rotate admin passwords and read the logs. Where intrusion is evident, rebuild from a backup confirmed to predate October 17, then rotate credentials and verify file integrity. Only sites holding a live UpdraftCentral key could be reached this way. The incident has been passed on to British regulators at the ICO.
