Breaches · 18h ago
After TeamUpdraft’s website breach, Patchstack says attackers began using stolen UpdraftCentral keys on October 18 to backdoor connected WordPress sites, finding at least 99 malicious plugins. BleepingComputer reports that the keys could potentially expose roughly 400,000 sites.
These keys are delegated control credentials: they let attackers send commands through the remote-management channel site owners had authorized. Patchstack says attackers used that access to run code, create administrator accounts and install backdoor plugins disguised as maintenance tools.
TeamUpdraft says it replaced potentially affected keys and credentials, but that does not establish that sites already reached were cleaned. If an agency manages many WordPress installs through UpdraftCentral, the vendor-side breach can leave rogue accounts and backdoors on individual sites even after the shared keys stop working.
3 sources covering this story
WordPress sites compromised after TeamUpdraft credential exposure
Attackers used exposed UpdraftCentral credentials to install malicious plugins and establish persistent access on connected WordPress sites.
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Attackers used compromised UpdraftCentral keys to install WordPress backdoors after a TeamUpdraft website breach, prompting key resets.
Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.
Part of the PlainSec briefing for 2026-10-22