Stolen UpdraftCentral keys used to backdoor WordPress sites

TeamUpdraft, developer of popular WordPress plugins including UpdraftPlus and UpdraftCentral, suffered an unauthorized access incident that exposed customer databases and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone services. Attackers used stolen UpdraftCentral keys to send signed commands to connected WordPress sites, installing backdoor plugins disguised as maintenance tools. These backdoors enable arbitrary code execution and creation of administrator accounts. The attack campaign began on October 18, 2026. Initial patches intended to remove UpdraftCentral Cloud keys were incomplete due to a bug, but subsequent updates (UpdraftPlus 1.26.13 / 2.26.13 and later) address the issue. Users must also manually delete UpdraftCentral keys from their WordPress settings to fully mitigate the threat.

The compromise allows attackers to remotely execute arbitrary code and create privileged administrator accounts on WordPress sites connected via UpdraftCentral. This results in full site takeover capabilities, including the installation of persistent backdoor plugins. Approximately 400,000 websites are potentially exposed due to the widespread use of UpdraftCentral keys. The breach also exposed customer data such as password hashes and two-factor authentication settings, though no payment information was stored. The attack does not exploit vulnerabilities in WordPress or UpdraftPlus directly but leverages stolen valid credentials to bypass security controls.

TeamUpdraft has revoked compromised keys and released official patches in UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) or later. Users should update to these versions immediately. After updating, administrators must log into each WordPress site and manually delete UpdraftCentral connection keys via Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys. It is recommended to inspect logs and files for indicators of compromise. If a site is confirmed compromised, restore from clean backups, change TeamUpdraft account passwords, revoke all sessions, and reset two-factor authentication settings. Users should rotate storage credentials and reauthorize connections if they accessed sites through UpdraftCentral. The vendor’s initial patch attempt had a bug preventing full key removal, so applying the latest update is critical.