UpdraftCentral got hacked. If you use Updraft plugins, update as soon as possible

If you’re running a WordPress site with plugins like UpdraftPlus, your site may be affected by a security incident involving the developer of those plugins.

TeamUpdraft (creators of UpdraftPlus and UpdraftCentral) was recently hacked, and an attacker was able to gain access to their customer database. The attacker was then able to install backdoor plugins on connected WordPress sites.

Affected users include anyone who connected their WordPress site or any WordPress plugins to Updraft Central.

Steps to keep your WordPress site safe

If you think you may be affected, there are three main steps to take to protect your WordPress site:

• Update any Updraft plugins via WordPress to the latest available version.
• Check that you recognise all the plugins installed on your WordPress website. Uninstall any you don’t recognise.
• Follow the full list of steps on TeamUpdraft’s blog about the incident to keep your site safe. There are many more measures they recommend taking, like checking for unfamiliar administrator accounts inside UpdraftCentral.

UpdraftPlus is a WordPress plugin for making and restoring site backups. Users often connect UpdraftPlus to UpdraftCentral, a tool for managing multiple WordPress sites from the same place. Sites connected to UpdraftCentral are affected by this incident. If you’re using those tools, we encourage you to update your WordPress plugins and make sure that you recognise all plugins installed on your site.