TeamUpdraft Breach Exposes Connection Keys Used to Backdoor WordPress Sites

TeamUpdraft, the developer behind the widely used UpdraftPlus WordPress backup plugin, disclosed that unknown attackers breached its website and accessed customer connection keys used for UpdraftCentral, UpdraftVault, and UpdraftClone, enabling backdoor access to connected WordPress sites.

The company said it detected unauthorized access to teamupdraft.com over the weekend of October 17–18 and immediately shut down the intrusion route, signed out all accounts, and replaced keys and credentials that may have been compromised. The attackers are believed to have accessed a customer database containing names, email addresses, billing details, order history, hashed passwords, 2FA settings, and connection keys for its remote‑management services. TeamUpdraft emphasized that no financial data was stored on its systems.

The vendor released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) to automatically disconnect all UpdraftCentral connections created before 10 p.m. BST on October 18. It also issued new credentials for UpdraftVault, replaced all UpdraftClone client keys, rotated keys with payment providers, deployed additional monitoring, and reported the incident to the UK Information Commissioner’s Office.

Customers were urged to change passwords immediately, reset 2FA, and treat unexpected emails claiming to be from TeamUpdraft with caution. Cloud users of UpdraftCentral were advised to disconnect their sites, update the plugin, remove unknown administrator accounts or plugins, change admin passwords, and restore from backups if suspicious activity is found.

The breach coincided with active exploitation observed by Patchstack, which reported attackers using valid UpdraftCentral dashboard keys to install backdoor plugins across WordPress sites for an 18‑hour period on October 18–19. The rogue plugin created hidden accounts with elevated permissions, enabling attackers to upload arbitrary PHP plugins, modify settings, and maintain access even after the plugin was removed. Nethemba, which first detected the attack, said the backdoor checked for a secret URL parameter and created an account named “data‑ops43” with Editor privileges and additional capabilities.

Patchstack identified 99 distinct backdoor plugin names and multiple suspicious account names used across compromised sites. Wordfence noted that sites were vulnerable if they had UpdraftPlus installed and an active connection key for TeamUpdraft’s cloud‑hosted UpdraftCentral service during the incident. The event marks the second UpdraftCentral‑related security issue in five months, following a June vulnerability that allowed unsigned command forgery.

The incident also comes days after a separate supply‑chain attack on the Rank Math PRO plugin, which distributed compromised versions containing hidden backdoors, and as PHP prepares emergency patches for two critical vulnerabilities affecting all major PHP versions.