WordPress sites compromised after TeamUpdraft credential exposure
CSO Online ·
Attackers are using stolen connection keys exposed in a TeamUpdraft security breach to install malicious plugins on affected WordPress sites and establish persistent access. Sites already compromised may remain at risk even after the exposed credentials are revoked. The attacks followed unauthorized access to TeamUpdraft’s website. The company, which develops the UpdraftPlus backup plugin and related WordPress management services, confirmed that its customer database was likely accessed. The incident exposed potentially sensitive information, including connection keys used by UpdraftCentral, a service that lets administrators manage multiple WordPress sites remotely. TeamUpdraft says it has closed the access route and released UpdraftPlus versions 1.26.13 and 2.26.13 for its free and Premium users, respectively, to revoke older UpdraftCentral Cloud connections. However, WordPress security firm PatchStack reported that attackers had already used the exposed credentials to execute commands on connected sites and install malicious plugins. The UpdraftPlus plugin itself and its downloads were not compromised, the company said in a blog post , adding that backups stored in customers’ own remote storage, including Google Drive, Dropbox and Amazon S3 , were also not affected. “However, if your site was accessed through UpdraftCentral, please also re-authorise your remote storage and change any storage access keys, as a precaution,” it added. UpdraftPlus surpassed four million active WordPress installations in October, although only sites connected to UpdraftCentral through an active key are exposed to this particular attack. Stolen keys enabled remote site access Attackers were seen using exposed UpdraftCentral credentials to issue commands to connected WordPress sites. Patchstack observed attacks beginning on October 18, with malicious plugins to establish persistent access and create accounts with administrative privileges. Patchstack researchers identified at least 99 variants of malicious plugins, some disguised as routine maintenance or optimisation tools. Nethemba, a web application security firm, reported that attackers targeted three of its WordPress sites through the remote-management channel and successfully installed malicious plugins on two of them. Some backdoor variants can create privileged accounts or authenticate as existing administrators, while others are designed to evade detection in WordPress’s standard administrators screens. Revoking the original connection key does not automatically remove rogue plugins, accounts or active sessions created during an attack, the researchers said. WordPress admins face a cleanup job TeamUpdraft has signed out customer accounts, reset login security, replaced UpdraftVault and UpdraftClone credentials, and introduced additional monitoring. It has also reported the incident to the UK Information Commissioner’s Office and other relevant authorities. The potentially accessed customer databases contained names, email, and billing addresses, order histories, password hashes, two-factor authentication settings, and service connection keys. “We do not store any card details. All card payments are handled by Stripe and PayPal,” the company clarified. Administrators using UpdraftCentral Cloud have been advised to update to safer UpdraftPlus versions and inspect each connected site directly. Recommended checks include deleting remaining UpdraftCentral connection keys, reviewing administrator accounts and installed plugins, changing administrator passwords, and examining logs for suspicious activity. Sites showing signs of compromise may need to be restored from a verified backup created before October 17, followed by credential rotation and integrity checks. TeamUpdraft recommends changing account passwords and resetting two-factor authentication where applicable.