Updraft breach

  • JMDP

    (@jmvdp)


    1 week, 5 days ago

    Hi,
    does anyone has a complete procedure to clean and restore websites.

    It seems that only deleting visible suspect admin account and visible suspect plugins is not sufficent. Some invisible users/plugins are only visible via ftp and when a fake admin is deleted it appears that it auto-regenerate a new account and same for plugins using other names.

    How to neutralize this function?

    Reason why I ask if someone has a global procedure including an anti “pirate revival”.

    Thanks

Viewing 2 replies - 1 through 2 (of 2 total)
  • Tomas

    (@tomcz)

    1 week, 4 days ago

    Try wordfence, it can scan files and db – https://wordpress.org/plugins/wordfence/

    Also look to tables in db like wp_users and wp_usermeta.

    This will shows admins – 

    SELECT * FROM wp_usermeta WHERE meta_key LIKE 'wp_user_level' AND meta_value LIKE '10'

    However, some php file uploaded by attacker contains code for giving ordinary user admin’s right. So there won’t be record about it in db.

    I found some php files in wp-content/cache folder.

    Anyway, if you can, use wordfence.

    Plugin Contributor bcrodua

    (@bcrodua)

    1 week, 3 days ago

    Hi @jmvdp,


    The blog post here: https://teamupdraft.com/blog/security-incident-october-2026/ explains the timeline, the steps we’ve taken and steps we’re urging our users to take.

    We’re sorry for any concern and disruption this has caused and are working hard to resolve this incident.

    If you have any specific questions, you can reply to this ticket.

    Best Wishes,
    Bryle

Viewing 2 replies - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.