WordPress site owners faced an uncomfortable lesson in October: a site can be fully patched and still be compromised if the attack arrives through a channel it is designed to trust. TeamUpdraft, maker of the UpdraftPlus backup plugin, says someone broke into its own website over the weekend of 17-18 October and likely reached its customer database, including connection keys for its UpdraftCentral remote-management service. Those keys let a central dashboard send commands to connected WordPress sites, and attackers used stolen keys to do exactly that.

Backdoors disguised as maintenance plugins

Researchers report the campaign began on 18 October at 15:32 UTC and ran about 18 hours. Attackers used correctly signed UpdraftCentral commands, so the plugin treated them as genuine, to install backdoor plugins and create administrator accounts. At least 99 backdoor plugins under different names were logged, many disguised as maintenance, caching or optimisation tools, including one called Site Health Cache. Because roughly 10% of UpdraftPlus sites hold an UpdraftCentral or Migrator key, researchers estimate around 400,000 websites could potentially be exposed. That figure is an exposure estimate, not a confirmed victim count, but it shows why the incident spread so fast.

Updating alone does not clean an infected site

TeamUpdraft says plugin files and downloads were not affected, and it stores no card details. The urgent fix is to update UpdraftPlus to 1.26.13, or Premium 2.26.13, and then manually delete every existing UpdraftCentral key in the plugin settings, because an early fix release had a bug that left keys in place. Crucially, updating revokes the stolen keys but does not remove a backdoor already installed. Site owners must inspect plugin folders and user lists for anything unfamiliar, and restore from a backup made before 17 October if compromise is confirmed, while changing passwords and resetting two-factor authentication.