Stolen Backup Keys Allow Hackers to Control WordPress Sites

How the Attack Unfolded

A cybercriminal group infiltrated the website of TeamUpdraft, a developer of widely used WordPress backup and security plugins, over the weekend. The breach exposed UpdraftCentral connection keys that could let attackers issue commands to any WordPress site linked through the platform. The company confirmed unauthorized access to its infrastructure and suspects the attacker accessed its customer database.

The intrusion was discovered by TeamUpdraft’s security team during routine monitoring. Investigations suggest the attackers exploited a vulnerability on the company’s public-facing site, allowing them to retrieve the encrypted keys used by UpdraftCentral. These keys are critical for managing backups and performing maintenance tasks on connected WordPress installations. Once in possession of the keys, a hacker could potentially schedule malicious scripts, delete data, or gain further access to the sites without the site owners’ knowledge.

What Does This Mean for WordPress Users?

TeamUpdraft’s incident response team traced the breach to a series of suspicious login attempts originating from a single IP block. The attackers used a combination of credential stuffing and a zero‑day exploit to bypass the site’s authentication mechanisms. Once inside, they navigated to the database that stores the UpdraftCentral keys. The keys are stored in an encrypted format, but the encryption key was also compromised, allowing the attackers to decrypt the values. The compromised keys were then copied and stored in a staging environment for later use.

According to the company’s statement, the attackers did not immediately exploit the keys but likely planned a staged attack. By holding the keys, the hackers could target multiple WordPress sites in the future, potentially scaling the damage across a large number of customers. TeamUpdraft is currently notifying affected clients and providing guidance on how to rotate keys and secure their installations.

Frequently Asked Questions

WordPress site owners who rely on UpdraftCentral for backup and security management face a new threat vector. If their keys are compromised, attackers could force a site to run arbitrary code, delete backups, or even take over the site entirely. The incident underscores the importance of multi‑factor authentication, regular key rotation, and monitoring for unusual activity on backup management platforms.

Site administrators should immediately audit their UpdraftCentral configurations, revoke any suspicious keys, and generate new ones. They should also review their backup logs for signs of unauthorized activity. In addition, WordPress users are advised to keep all plugins and themes up to date, as outdated components can provide additional entry points for attackers.