Some backdoor variants can create privileged accounts or authenticate as existing administrators, while others are designed to evade detection in WordPress’s standard administrators screens. Revoking the original connection key does not automatically remove rogue plugins, accounts or active sessions created during an attack, the researchers said.
WordPress admins face a cleanup job
TeamUpdraft has signed out customer accounts, reset login security, replaced UpdraftVault and UpdraftClone credentials, and introduced additional monitoring. It has also reported the incident to the UK Information Commissioner’s Office and other relevant authorities.
The potentially accessed customer databases contained names, email, and billing addresses, order histories, password hashes, two-factor authentication settings, and service connection keys. “We do not store any card details. All card payments are handled by Stripe and PayPal,” the company clarified.
