Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.
According to Patchstack lead researcher Oliver Sild , attackers have begun using stolen access keys to backdoor sites connected to UpdraftCentral, saying the campaign may be more severe than the " wp2shell ” attack.
An estimated 10% of sites using UpdraftPlus have an UpdraftCentral or Migrator key, potentially exposing around 400,000 websites to the attack.
The researchers logged at least 99 malicious backdoor plugins with distinct names disguised as WordPress maintenance and optimization tools, such as “Site Health Cache.” Although Patchstack describes an early variant of the backdoor plugin that is broken due to a coding error, a report from web application security firm Nethemba documents a newer version that lets attackers create privileged accounts or log in as existing administrators.
The attacker came in through the UpdraftCentral remote management channel and signed the commands with valid private dashboard keys” Nethemba reports that the vendor's initial 1.26.12/2.26.12 release was meant to remove UpdraftCentral Cloud keys, but a bug prevented it from doing so.
Even if backups in customers' own remote storage are unaffected, the company recommends that users rotate storage credentials and reauthorize connections if they accessed their site through UpdraftCentral.
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.
TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database.
WordPress backup plugin flaw exposes millions of sites to takeover attacks
The WordPress plugin security company says that the attacks started on October 18 at 15:32 UTC to execute arbitrary code and add accounts with full administrator privileges.
If compromise is confirmed, it is recommended to restore sites from clean backups, change the TeamUpdraft account password, revoke all sessions, and reset the two-factor authentication protection method.
What happened
According to Patchstack lead researcher Oliver Sild , attackers have begun using stolen access keys to backdoor sites connected to UpdraftCentral, saying the campaign may be more severe than the " wp2shell ” attack.
An estimated 10% of sites using UpdraftPlus have an UpdraftCentral or Migrator key, potentially exposing around 400,000 websites to the attack.
What changed
The researchers logged at least 99 malicious backdoor plugins with distinct names disguised as WordPress maintenance and optimization tools, such as “Site Health Cache.” Although Patchstack describes an early variant of the backdoor plugin that is broken due to a coding error, a report from web application security firm Nethemba documents a newer version that lets attackers create privileged accounts or log in as existing administrators.
The attacker came in through the UpdraftCentral remote management channel and signed the commands with valid private dashboard keys” Nethemba reports that the vendor's initial 1.26.12/2.26.12 release was meant to remove UpdraftCentral Cloud keys, but a bug prevented it from doing so.
Who is affected
Even if backups in customers' own remote storage are unaffected, the company recommends that users rotate storage credentials and reauthorize connections if they accessed their site through UpdraftCentral.
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.
Why it matters
TeamUpdraft detected unauthorized access to its infrastructure over the weekend and believes that the hacker accessed the customer database.
WordPress backup plugin flaw exposes millions of sites to takeover attacks
Technical details
The WordPress plugin security company says that the attacks started on October 18 at 15:32 UTC to execute arbitrary code and add accounts with full administrator privileges.
If compromise is confirmed, it is recommended to restore sites from clean backups, change the TeamUpdraft account password, revoke all sessions, and reset the two-factor authentication protection method.
Administrators should inspect logs and files for indicators of compromise provided by TeamUpdraft, Patchstack, and Nethemba.
Response
Users are recommended to update UpdraftPlus to 1.26.13 (free) / 2.26.13 (Premium) or later.
After updating, it is recommended to log into each WordPress site and delete the UpdraftCentral connection keys from Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys.
Attribution
BleepingComputer: A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.
What to watch next
Watch for updated vendor guidance and fixed-version details.