TeamUpdraft Breach Exposes WordPress Sites to Backdoor Attacks via Stolen UpdraftCentral Keys
Attackers who breached TeamUpdraft’s customer database over the weekend of October 17–18 exploited stolen UpdraftCentral connection keys to install backdoor plugins on WordPress sites. The company, which develops the UpdraftPlus backup plugin (used on over 4 million sites), disclosed the incident in a security notice, while researchers at Patchstack documented the subsequent malicious activity.
What Was Compromised?
TeamUpdraft confirmed that intruders accessed its customer database, containing:
- User data: Names, email addresses, billing details, order history, and hashed passwords.
- Two-factor authentication (2FA) settings.
- Connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone tools that allow remote management of WordPress sites.
Notably, payment card data was not exposed, as transactions are processed via Stripe and PayPal. The UpdraftPlus plugin itself remained untampered, meaning the attack did not rely on a supply-chain compromise.
How the Attack Unfolded
Between October 18–19, attackers used valid, signed UpdraftCentral commands to deploy malicious plugins on connected WordPress sites. Since the instructions were encrypted and authenticated with legitimate keys, sites executed them without triggering security alerts no software vulnerabilities were exploited.
The backdoor created:
- A hidden "editor" account with plugin installation privileges.
- A cookie-based login bypass, allowing attackers to skip 2FA and the login screen entirely.
Detection and Indicators of Compromise
Patchstack identified two key indicators:
- A plugin named "Small maintenance toolkit".
- A user account labeled "Site Tools".
Additionally, defenders were advised to check the Must-Use plugins directory, where malicious plugins load automatically without appearing in the standard plugin list.
TeamUpdraft’s Response
The company released UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium) to invalidate all pre-October 18 UpdraftCentral connections. Measures included:
- Signing out all accounts and rotating payment provider keys.
- Disconnecting UpdraftVault sites and replacing UpdraftClone client keys.
- Reporting the breach to the UK Information Commissioner’s Office (ICO).
Affected users were instructed to delete old connection keys and scan for unknown administrators or plugins, with compromised sites advised to restore from pre-October 17 backups.
Broader Implications
The incident highlights the risks of centralized management tools stolen credentials can grant attackers full control over connected sites without exploiting vulnerabilities. Security firm Nethemba confirmed finding the backdoor on two fully patched sites, demonstrating that patching alone is insufficient against credential-based attacks.
TeamUpdraft has not disclosed how many sites received the malicious plugin, leaving the full scope of the compromise unclear. The breach underscores the need for strict access controls and proactive monitoring in WordPress environments.
TeamUpdraft cybersecurity rating report: https://www.rankiteo.com/company/teamupdraft
"id": "TEA1792499488",
"linkid": "teamupdraft",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Over 4 million WordPress sites '
'using UpdraftPlus',
'industry': 'Software (WordPress plugins)',
'location': 'UK',
'name': 'TeamUpdraft',
'type': 'Company'}],
'attack_vector': 'Stolen credentials (UpdraftCentral connection keys)',
'customer_advisories': 'Security notice with remediation steps',
'data_breach': {'data_encryption': 'Hashed passwords',
'personally_identifiable_information': 'Names, email '
'addresses, billing '
'details',
'sensitivity_of_data': 'High (personal, billing, and '
'authentication data)',
'type_of_data_compromised': ['User data',
'Connection keys',
'2FA settings']},
'date_detected': '2023-10-18',
'description': 'Attackers who breached TeamUpdraft’s customer database '
'exploited stolen UpdraftCentral connection keys to install '
'backdoor plugins on WordPress sites. The company, developer '
'of the UpdraftPlus backup plugin, disclosed the incident '
'while researchers at Patchstack documented the malicious '
'activity.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'User data (names, email addresses, billing '
'details, order history, hashed passwords), '
'2FA settings, '
'UpdraftCentral/UpdraftVault/UpdraftClone '
'connection keys',
'identity_theft_risk': 'Yes (exposure of personal and billing '
'data)',
'operational_impact': 'Unauthorized plugin installations, hidden '
'admin accounts, cookie-based login bypass',
'payment_information_risk': 'No (payment data processed via Stripe '
'and PayPal)',
'systems_affected': 'WordPress sites using UpdraftCentral, '
'UpdraftVault, or UpdraftClone'},
'initial_access_broker': {'backdoors_established': "Hidden 'editor' account, "
'cookie-based login bypass',
'entry_point': 'Customer database breach',
'high_value_targets': 'WordPress sites using '
'UpdraftCentral'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Risks of centralized management tools, importance of '
'strict access controls, limitations of patching alone '
'against credential-based attacks',
'post_incident_analysis': {'corrective_actions': 'Key rotation, enhanced '
'access controls, user '
'advisories',
'root_causes': 'Stolen UpdraftCentral connection '
'keys, lack of proactive monitoring '
'for unauthorized plugin '
'installations'},
'recommendations': ['Delete old connection keys',
'Scan for unknown administrators/plugins',
'Restore from pre-October 17 backups',
'Proactive monitoring of WordPress environments'],
'references': [{'source': 'Patchstack'},
{'source': 'TeamUpdraft Security Notice'},
{'source': 'Nethemba'}],
'regulatory_compliance': {'regulatory_notifications': 'Reported to UK '
'Information '
'Commissioner’s Office '
'(ICO)'},
'response': {'communication_strategy': 'Security notice to users, breach '
'report to UK ICO',
'containment_measures': 'Invalidated pre-October 18 '
'UpdraftCentral connections, signed out '
'all accounts, rotated payment provider '
'keys, disconnected UpdraftVault sites, '
'replaced UpdraftClone client keys',
'incident_response_plan_activated': 'Yes',
'recovery_measures': 'Restore from pre-October 17 backups',
'remediation_measures': 'Released UpdraftPlus 1.26.12/2.26.12 to '
'invalidate old connections, advised '
'users to delete old keys and scan for '
'unknown admins/plugins',
'third_party_assistance': 'Patchstack (research), Nethemba '
'(security firm)'},
'stakeholder_advisories': 'Affected users instructed to delete old keys and '
'scan for backdoors',
'title': 'TeamUpdraft Breach Exposes WordPress Sites to Backdoor Attacks via '
'Stolen UpdraftCentral Keys',
'type': 'Data Breach, Backdoor Attack'}