Remote-management credentials lifted from TeamUpdraft let attackers push malicious plugins onto connected sites, and revoking the key does not undo…