Attackers who broke into the customer database of TeamUpdraft, the company behind the UpdraftPlus backup plugin, have used stolen UpdraftCentral connection keys to install backdoor plugins on WordPress sites. The company disclosed the breach in a security notice, and researchers at Patchstack documented the malicious plugin installs that followed.
What TeamUpdraft Says Attackers Took From Its Customer Database
TeamUpdraft says attackers likely accessed its customer database over the weekend of October 17 and 18. The company has not described how the intruders got in. It says it has closed the access route and fixed the underlying weakness. It also states that the UpdraftPlus plugin itself and its downloads were not tampered with, so the plugin code distributed to sites was not the delivery vehicle for the attack.
The database holds customer names, email addresses, billing addresses, order history, hashed passwords and two-factor authentication settings. TeamUpdraft says it does not store card data, because Stripe and PayPal process its payments. The company has not said how many accounts the database contains. UpdraftPlus runs on more than four million WordPress sites, but most free users have no account with the company.
UpdraftCentral Connection Keys Were the Most Dangerous Item in the Haul
The database also holds connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Those keys let a remote dashboard talk to a WordPress site and issue commands. TeamUpdraft tells every holder of a teamupdraft.com account to assume their data leaked. Users of the cloud version of UpdraftCentral face the highest risk, because a stolen key can give an outsider remote control of the sites linked to that account.
Self-hosted UpdraftCentral installations are not affected, according to the company. Backups stored in Google Drive, Dropbox or Amazon S3 are also outside the scope of the breach.
How Signed UpdraftCentral Commands Installed Malicious Plugins
Patchstack observed UpdraftCentral commands installing malicious plugins on WordPress sites between October 18 and October 19. The commands were correctly encrypted and signed with genuine dashboard private keys. Target sites therefore treated them as legitimate instructions from a trusted management dashboard and carried them out without any sign of a software flaw being exploited.
That detail separates this incident from a typical plugin vulnerability. The sites were not compromised through a bug in WordPress or in UpdraftPlus. The attackers held valid credentials, and the sites did what a connected dashboard is designed to make them do. Security firm Nethemba reported finding the malicious plugin on two of its own sites, both of which were fully patched.
A Hidden Editor Account and a Cookie That Skips the Login Form and 2FA
According to Patchstack, the backdoor creates a hidden account with editor rights and the power to install plugins. It then logs the attacker in through a cookie that bypasses the login form and two-factor authentication. An administrator who relies on 2FA to protect a site would see no prompt, because the session never passes through the login screen.
Indicators Patchstack Published: “Small maintenance toolkit” and “Site Tools”
Patchstack lists two indicators for defenders. One is a plugin described as “Small maintenance toolkit.” The other is a user account named “Site Tools.” The firm also advises checking the Must-Use plugins directory, since plugins placed there load automatically and do not appear in the standard plugin list.
TeamUpdraft’s Response and the UpdraftPlus 1.26.12 and 2.26.12 Releases
TeamUpdraft invalidated every UpdraftCentral connection made before 22:00 BST on October 18 through new releases. It signed out every account, rotated its payment provider keys, disconnected all UpdraftVault sites and replaced every UpdraftClone client key. The fixed versions are UpdraftPlus 1.26.12 for the free edition and 2.26.12 for Premium. The company reported the incident to the UK Information Commissioner’s Office.
TeamUpdraft advises customers to delete old connection keys and look for unknown administrators and plugins. Customers who find signs of compromise should restore from a backup taken before October 17.
Why Stolen Management Keys Make Backdoor Detection Harder
Tools built to manage many sites at once concentrate risk: whoever holds the management credentials holds every connected site. In this incident the attackers needed no exploit, only keys that sites were built to trust.
The Nethemba finding shows the practical consequence. Patching does not remove an attacker who already holds a valid signed command channel, and cleanup requires hunting for the hidden account and plugin directly. The backdoor installs that Patchstack saw began on October 18, the same weekend as the database access. TeamUpdraft has not yet said how many sites received the malicious plugin, a figure that will determine how widely this incident spreads through the WordPress ecosystem.
