Popular WordPress Plugin Hacked: 400,000 Websites at Risk

What happened?

Over the weekend of 17-18 October, unknown attackers breached TeamUpdraft’s servers, gaining access to their customer database. While the company confirmed that payment details were not stored, the database did contain order histories and other personal client information. Most alarmingly, hackers obtained UpdraftCentral connection keys.

These keys allow users to remotely send commands to connected websites. According to security researchers, attackers have already begun using these keys to infect websites with backdoors. Data from Patchstack indicates that since 18 October, hackers have been executing arbitrary code and creating new administrator accounts, granting them full control over affected sites.

How to protect your website

Security experts and TeamUpdraft are urging users to take immediate action. First, you must update the UpdraftPlus plugin to version 1.26.13 for the free version or 2.26.13 for the Premium version. However, updating alone is insufficient because attackers may have already accessed your system.

After updating, you must follow these steps:

1. Log in to your website’s admin panel.
2. Navigate to Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral > Manage existing keys.
3. Delete all existing connection keys.
4. Change your TeamUpdraft account password and terminate all active sessions.
5. Reset your two-factor authentication (2FA) method.

Why this matters

This incident serves as a reminder that even if your own site is secure, third-party service compromises can pose a direct threat. As experts from Nethemba note, the hackers did not break into the servers directly; they used legitimate, verified keys to gain entry. If you manage a WordPress site and use this plugin, do not delay these security measures. Check your site logs for unknown administrators or suspicious files. If you discover your site has been compromised, the best course of action is to restore it from a clean backup.