TeamUpdraft Reveals Breach of Website Exposing Remote Management Keys
TeamUpdraft, the organization responsible for the UpdraftPlus plugin utilized in WordPress backup solutions, has reported a significant security breach.
This incident has compromised remote management keys, subsequently allowing malicious actors to install nefarious plugins on associated WordPress sites, effectively transforming a reputable management feature into a conduit for executing harmful code.
During the period of October 17–18, 2026, the company detected unauthorized access to teamupdraft.com.
It is believed that attackers acquired entry into the customer database, which potentially includes sensitive information such as names, email addresses, billing details, order histories, password hashes, two-factor authentication configurations, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone.
Malicious Plugins Installed by Intruders
UpdraftCentral serves as a hub for administrators to oversee multiple WordPress sites from a singular dashboard.
Sites linked to this service trust commands that are authenticated by the dashboard’s private key, executing those commands with the authorizations of the WordPress user who established the connection.
Research conducted by Nethemba has revealed that attackers were able to dispatch the plugin.upload_plugin command utilizing valid keys.
In scenarios where the associated user possessed the capability to install and activate plugins, WordPress acquiesced, thereby loading the harmful PHP code.
Interestingly, on one examined site, the intrusion was thwarted as the linked user lacked requisite permissions.
This circumstance does not constitute a revival of the previously addressed CVE-2026-10795 security flaw. The affected sites under Nethemba’s scrutiny had already implemented UpdraftPlus version 2.26.11.
The compromised keys facilitated the passage of requests through standard checks, circumventing the necessity to exploit the prior vulnerability.
Investigators have uncovered backdoors masquerading as benign maintenance tools. Functioning variants possess the capability to grant attackers entry into existing administrator accounts or to forge new ones.
Certain backdoors remain hidden within the plugin list, while malfunctioning versions generate PHP errors, resulting in website outages.
Consequently, a standard administrator list cannot definitively rule out the possibility of compromise.
Both free and Premium UpdraftPlus users may find themselves at risk, provided that their sites retained the compromised cloud connection keys associated with UpdraftCentral.
Merely installing UpdraftPlus does not inherently forge such connections; however, linking to a TeamUpdraft account may present a default option to incorporate the site into UpdraftCentral, necessitating a review of potentially overlooked connections.
TeamUpdraft has stipulated that the plugin itself, along with its downloadable packages, remains unaltered.
This sets it apart from the GravityForms supply chain incident, wherein malicious code infiltrated user systems through compromised downloads.
Previous exposures involving UpdraftPlus backups pertained to distinct plugin vulnerabilities, rather than pilfered cloud management keys.
The vendor confirms that their self-hosted UpdraftCentral and backups stored within customers’ personal Google Drive, Dropbox, or Amazon S3 accounts were spared from the ramifications of this breach.
Nonetheless, sites accessed via UpdraftCentral are advised to renew storage access as a precautionary measure.
In response to the breach, TeamUpdraft has shut down the compromised access pathway, logged out customer accounts, rotated service credentials, and informed the relevant authorities.
Importantly, payment card information is not stored by the company, with transactions processed through Stripe and PayPal.
Administrators are urged to update to UpdraftPlus version 1.26.13 Free or 2.26.13 Premium, or any subsequent versions.
The official changelog indicates that these updates rectify the key removal issue that emerged in 1.26.12.
Furthermore, Nethemba has reported a cutoff mismatch that may leave some exposed keys remaining, highlighting the need for manual verification to mitigate risks.
Administrators must log directly into each WordPress dashboard and navigate to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral.
It is essential to eliminate outdated connection keys, examine plugin files and server logs, and scrutinize for unfamiliar users. Updating or obliterating keys cannot eradicate any backdoors already implanted.
TeamUpdraft account holders should alter their passwords, replace reused passwords across other platforms, and reset their two-factor authentication settings.
Additionally, administrators ought to revise site administrator passwords. Should any dubious activity arise, TeamUpdraft recommends considering restoration from a backup made prior to October 17.
Only once thorough checks and site security measures are implemented should cloud services be reconnected.
Source link: Cybersecuritynews.com.
