TeamUpdraft, the developer behind popular WordPress backup and security plugins, has suffered a website breach. The attackers stole UpdraftCentral connection keys, which are used to link WordPress sites to the UpdraftCentral management dashboard. These keys can send commands to connected sites, giving the holder significant control over them.
According to the report, the stolen keys were used to backdoor WordPress sites. This means the attackers could inject malicious code or otherwise compromise sites that were connected through UpdraftCentral. The exact scope of the abuse is not yet fully detailed, but the risk is serious for any site using the service.
WordPress administrators who use UpdraftCentral should treat their keys as compromised. Rotating the connection keys and auditing sites for unfamiliar changes or admin accounts are prudent first steps. The incident highlights how a single stolen credential can ripple across many independent websites that rely on a central management tool.