An attacker holding valid connection keys for UpdraftCentral installed backdoor plugins on WordPress sites connected to the service, in a campaign that ran through an 18-hour window on 18 and 19 October. There is no software flaw to patch: the commands were correctly signed, so every check inside the plugin passed.
What happened
TeamUpdraft, the company behind UpdraftPlus, disclosed unauthorised access to its teamupdraft.com website over the weekend of 17 and 18 October. The customer database it believes was accessed held connection keys for UpdraftCentral, UpdraftVault and UpdraftClone, along with account details.
Those UpdraftCentral keys are the dangerous part. The client ships inside UpdraftPlus, and a site holding a key will execute any command signed with the dashboard's private key, which lives in TeamUpdraft's cloud service. Patchstack recorded the attacker sending a signed plugin upload command, which WordPress then installed and activated through its normal installer.
Each delivered plugin is a backdoor. It watches every request for a secret URL parameter and, when it sees the right token, creates an account with the Editor role, grants it the rights to install plugins and change settings, and logs the visitor straight in with a cookie. Because the account is an Editor it does not appear in a list of administrators, and because login happens by cookie, two-factor authentication never runs.
Patchstack's telemetry counted 99 distinct backdoor plugin names across affected sites, disguised as performance and utility tools. The campaign window it observed ran from 15:32 UTC on 18 October to 09:23 UTC on 19 October.
Who is affected
Any WordPress site holding a live UpdraftCentral connection key, which is a wider group than site owners who deliberately signed up for central management.
- Sites connected to an UpdraftCentral dashboard, including those added when a site was linked to a TeamUpdraft account.
- Sites where the UpdraftPlus screen for connecting a TeamUpdraft account was used, because the option to add the site to UpdraftCentral is ticked by default.
- Any UpdraftPlus version, old or current, on a site with an active key present.
- Self-hosted UpdraftCentral installations and the plugin downloads themselves were not part of the exposure.
What to do now
Delete the UpdraftCentral connection key on every site, then audit users by capability rather than by name. Updating UpdraftPlus alone has not been enough: version 1.26.12 was meant to revoke the old keys but removed none, and researchers who inspected 1.26.13 say some keys created earlier on 18 October survived it.
- Log in to each site's own WordPress dashboard, not through UpdraftCentral, and go to Settings, UpdraftPlus, Advanced Tools, UpdraftCentral to delete the key.
- Update UpdraftPlus to 1.26.13 or later, or the Premium equivalent, and check the Must-Use plugins tab as well as the normal plugin list.
- List users holding both manage_options and install_plugins, especially any Editor, and remove accounts you cannot account for.
- Search the plugins directory for the string "Small maintenance toolkit: keeps option storage tidy." which appears in the delivered backdoors.
- If anything is found, restore from a backup taken before 17 October, reinstall core, plugins and themes from source, and rotate database, hosting and remote-storage credentials.
- Change the teamupdraft.com password from a known-clean device and reset two-factor authentication there.
What this means for South African businesses
UpdraftPlus is one of the most installed backup plugins in the WordPress ecosystem, and a great many South African business sites are maintained by an agency that manages several of them from one dashboard, which is precisely the arrangement this attack targeted. The compromise also survives the obvious response: patching the plugin leaves an existing backdoor in place and leaves the stolen key working on any site that was not manually cleaned.
My assessment is that small sites are more exposed here than large ones, because the site owner usually assumes the plugin vendor handled it and never checks the user list for an Editor with administrator powers. On shared South African hosting, one compromised site in an account is often enough to reach the rest.
Patchstack's technical write-up, including the detection guidance behind this article, is available here.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.