GoKawiilTeamUpdraft breach exposes UpdraftCentral keys, hackers already backdooring sites
WordPress plugin maker TeamUpdraft disclosed that attackers breached its website over the weekend of October 17-18 and accessed its customer database, including password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. The company says payment data was not stored and was unaffected, and that UpdraftPlus plugin files remain untouched, but researcher Oliver Sild of Patchstack says stolen keys are already being used to backdoor WordPress sites.
GoKawiil's interpretation of the reporting above, not reported fact.
With roughly 10% of UpdraftPlus's 4 million-plus installs reportedly carrying an UpdraftCentral or Migrator key, the exposure could affect hundreds of thousands of sites that use the remote management feature, giving attackers a direct command channel into connected websites. The incident underscores how a breach at a single plugin vendor can cascade into widespread compromise across its customer base, making prompt credential rotation and reauthorization critical for affected site owners.
- TeamUpdraft confirmed unauthorized access to its website and customer database over October 17-18.
- Exposed data includes password hashes, 2FA settings, and UpdraftCentral/Vault/Clone connection keys, though no payment data was stored.
- Patchstack says attackers are already exploiting stolen keys to backdoor sites, with up to ~400,000 installs potentially at risk.
Source: bleepingcomputer.com, 2026-10-20
Published there as: “Stolen UpdraftCentral keys used to backdoor WordPress sites”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.