Hackers stole UpdraftCentral keys from TeamUpdraft and are using them to secretly take over WordPress sites. Up to 400,000 sites could be exposed.
Hackers broke into the website of TeamUpdraft, the company behind the popular UpdraftPlus backup plugin for WordPress. They are now using stolen keys to take over websites that were connected to it. The attacks began on October 18. If your site uses UpdraftPlus with UpdraftCentral, an attacker may already have control.
TeamUpdraft says it found unauthorized access to teamupdraft.com over the weekend of October 17 and 18. It believes the intruder reached its customer database. That data included customer and billing details and order history. The company says it stores no payment details, and that UpdraftPlus plugin files and downloads were not affected.
UpdraftCentral is a tool for managing many WordPress sites from one dashboard. It uses connection keys, which work like passwords that let the dashboard send commands to a site. Stolen keys let an attacker send those same commands.
Security firm Patchstack says attacks using the stolen keys started on October 18 at 15:32 UTC. Attackers ran their own code on sites and added accounts with full administrator power. Patchstack logged at least 99 fake plugins with different names, disguised as maintenance or speed tools. One example is called Site Health Cache.
Security firm Nethemba says three of its own sites were targeted, and two got a malicious plugin. All three were fully up to date. Nethemba says the attacker did not exploit a flaw. The commands were signed with valid keys, so the sites accepted them.
About 10% of sites using UpdraftPlus have an UpdraftCentral or Migrator key. That could mean around 400,000 websites. Self-hosted UpdraftCentral setups are not affected. If your site has no such key, this attack path does not apply to you.
The alert box above lists the steps. The short version is to update the plugin, remove old connection keys and check your site for things you did not add. One detail matters here. Nethemba reports that the first fix, version 1.26.12 or 2.26.12, was meant to remove the keys but a bug stopped it. Make sure you are on 1.26.13 or 2.26.13 or later.
TeamUpdraft also advises changing the passwords for any storage connected to your backups if you used UpdraftCentral, even though backups in your own storage were not reported as affected.
TeamUpdraft, Patchstack and Nethemba have each published signs of compromise that site owners can check against their logs and files. Patchstack says an early version of the fake plugin was broken by a coding error. Nethemba documents a newer version that works. More sites could be found compromised as people look.
If your WordPress site uses UpdraftPlus with UpdraftCentral, update it, delete the old keys and check for plugins or admin accounts you did not add.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesMorristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about you
