Stolen UpdraftCentral keys turn into a WordPress backdoor spree
Attackers breached plugin maker TeamUpdraft, lifted remote-management keys, and are installing fake maintenance plugins on live sites.
Key points
- Attackers who stole UpdraftCentral connection keys from plugin maker TeamUpdraft on 17-18 October 2026 are using them to install backdoor plugins on live WordPress sites, with Patchstack logging at least 99 distinct malicious plugin names.
- UpdraftPlus runs on more than four million WordPress sites; the vendor estimates roughly 10% hold an UpdraftCentral or Migrator key, putting around 400,000 sites in range.
- The stolen database included password hashes, two-factor authentication settings and remote-management keys for UpdraftCentral, UpdraftVault and UpdraftClone, but no payment details.
- Fully patched sites are being hit: Nethemba says two of its own sites, running UpdraftPlus 2.26.11 patched against CVE-2026-10795, were backdoored through the signed remote-management channel.
- Users should update to UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) and then delete every UpdraftCentral key from the plugin's advanced settings.
A break-in at the company behind one of WordPress's most-used backup plugins has turned into a live attack on the sites that trusted it.
TeamUpdraft, which makes UpdraftPlus, said it detected unauthorised access to teamupdraft.com over the weekend of 17-18 October 2026. The attacker reached the customer database, which held password hashes, two-factor authentication settings and the connection keys that let UpdraftCentral send commands to customer WordPress sites.
Those keys are the problem.
What are the attackers actually doing with the keys?
They're signing legitimate remote-management commands and using them to install malicious plugins that give them administrator access. UpdraftCentral is a dashboard product that lets an agency run many WordPress sites from one place. Whoever holds the private key can tell a connected site to do almost anything, including install a plugin.
Patchstack, a WordPress security firm, says the campaign began on 18 October at 15:32 UTC. Its lead researcher Oliver Sild logged at least 99 backdoor plugins with distinct names, dressed up as maintenance or optimisation tools. One is called "Site Health Cache." An earlier version of the backdoor was broken by a coding error. A later variant, documented by security firm Nethemba, can create new privileged accounts or log the attacker in as an existing administrator.
Nethemba reported that three of its own sites were targeted and two were successfully backdoored. All three were running current software, including UpdraftPlus 2.26.11, patched against the June flaw CVE-2026-10795. The attacker, Nethemba said, "came in through the UpdraftCentral remote management channel and signed the commands with valid private dashboard keys."
Patching didn't help, because the signed command looked legitimate. This is the uncomfortable part, and it's what separates this incident from the steady stream of plugin-code flaws we've covered across 21 WordPress stories in the last 90 days.
How does this compare to CVE-2026-10795?
The June bug was an authentication bypass in UpdraftPlus versions up to 1.26.4. According to the National Vulnerability Database entry, a flaw in signature verification collapsed the encryption key to all zeros, letting unauthenticated attackers forge commands and run them as the connected administrator. That earlier bug and the current breach reach the same end point, remote code execution on the site, by very different routes. One was a code flaw. This one is stolen credentials.
What should site owners do right now?
Update the plugin and then delete the keys. Install UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later. The vendor's first attempt at a fix, 1.26.12/2.26.12, was meant to wipe UpdraftCentral Cloud keys but a bug stopped it working, as first reported by BleepingComputer.
| Action | Where | Why |
|---|---|---|
| Update plugin | UpdraftPlus 1.26.13 / 2.26.13 | Earlier fix release did not clear keys |
| Delete UpdraftCentral keys | Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, Manage existing keys | Cuts off the signed-command channel |
| Reset TeamUpdraft account | teamupdraft.com | Password hashes and 2FA settings were in the stolen database |
| Rotate storage credentials | Remote backup provider | Vault and Clone keys were exposed |
Check server logs and the plugins directory against the indicators that TeamUpdraft, Patchstack and Nethemba have published. If a strange plugin is present, restore from a clean backup taken before 18 October.
My read: what makes this worse than the usual plugin-flaw cycle is that the attackers aren't exploiting bad code, they're riding a trust relationship the site already accepted. Anyone who ran UpdraftCentral should treat their key as burned until they've deleted it themselves.
