Stolen UpdraftCentral keys used to infect WordPress sites
The breach at TeamUpdraft has moved from a single vendor incident to active attacks on customer WordPress sites.
Stolen TeamUpdraft connection keys are being used to break into WordPress sites that rely on UpdraftCentral, turning a website breach at the plugin maker into a broader supply-chain style incident. TeamUpdraft says someone accessed its teamupdraft.com infrastructure over the weekend of 17–18 October, may have reached the customer database, and could have exposed customer, billing, order-history, password-hash, two-factor, and remote-management data. Patchstack says attacks began on 18 October at 15:32 UTC, and researchers have already counted at least 99 malicious backdoor plugins; Nethemba says three of its own sites were targeted and two were successfully infected. The vendor recommends upgrading to UpdraftPlus 1.26.13 for the free edition or 2.26.13 for Premium, then removing old UpdraftCentral keys and reviewing logs and files for signs of compromise.
Why it matters
For site owners using UpdraftCentral, the risk is no longer limited to possible exposure of account data. Stolen connection keys have been used to run code and add administrator accounts on target sites, so affected users need to treat their installs as potentially compromised and update to the fixed versions now.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BleepingComputer