Executive Summary
A threat actor breached the infrastructure of TeamUpdraft, a prominent developer of WordPress backup and management tools, compromising a customer database containing sensitive information. The stolen data includes password hashes, two-factor authentication settings, and critical connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone services.
Following the breach, attackers have been observed using these valid connection keys to sign and send remote commands to connected WordPress sites. This allows them to bypass traditional security perimeters and install backdoors even on sites patched against known vulnerabilities like CVE-2026-10795. The blast radius is significant, with approximately 400,000 websites potentially exposed to these unauthorized administrative actions.
Impacted organizations face full site compromise, including the creation of rogue administrator accounts and the installation of malicious plugins disguised as legitimate maintenance tools. The urgency is high as the attackers are using legitimate management channels to facilitate their activities, making detection through standard signature-based methods more difficult.