Stolen UpdraftCentral keys used to backdoor WordPress sites

Breach of TeamUpdraft's website exposes connection keys; attacks already under way on patched sites

By LineZotpaper

Published21 October 2026

Read Time2 min

TeamUpdraft, the developer of popular WordPress backup and management plugins, has disclosed that an attacker gained unauthorized access to its website and stole UpdraftCentral connection keys, which can send commands to connected websites. Security researchers say attackers are already using the stolen keys to install backdoors on WordPress sites, including fully patched ones, in a campaign that could affect roughly 400,000 websites.

TeamUpdraft said over the weekend of 17 to 18 October it detected unauthorised access to teamupdraft.com, its website for customers of UpdraftPlus, UpdraftCentral, UpdraftVault and UpdraftClone. The developer said it closed the access route, signed out every account and replaced keys and credentials that could have been affected. The company believes the attacker accessed its customer database, which included customer and billing details, order history, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it does not store payment details, and that UpdraftPlus plugin files and downloads remain unaffected. Self-hosted UpdraftCentral instances are not impacted.

UpdraftPlus is a backup and restoration plugin with more than 4 million downloads. Security firm Patchstack estimates that 10% of sites using UpdraftPlus have an UpdraftCentral or Migrator key, potentially exposing around 400,000 websites. Patchstack says attacks began on October 18 at 15:32 UTC, with attackers executing arbitrary code and adding accounts with full administrator privileges. Researchers logged at least 99 malicious backdoor plugins with distinct names disguised as maintenance tools such as "Site Health Cache."

Web application security firm Nethemba said three of its own WordPress websites were targeted through UpdraftCentral, with malicious plugins installed on two. "All three sites ran the current WordPress 7.1.3 and UpdraftPlus 2.26.11, which is patched against the June vulnerability CVE-2026-10795," Nethemba said. "The attacker did not break into our servers and did not exploit any weakness in our configuration. The attacker came in through the UpdraftCentral remote management channel and signed the commands with valid private dashboard keys." Nethemba also reported that an earlier TeamUpdraft release meant to remove UpdraftCentral Cloud keys failed to do so because of a bug.

TeamUpdraft recommends users update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later, delete existing UpdraftCentral connection keys, and rotate storage credentials. Administrators are advised to inspect logs and files for signs of compromise, restore sites from clean backups if needed, change their TeamUpdraft account password, revoke all sessions and reset two-factor authentication.

Analysis

Why This Matters

The attack uses a legitimate remote management channel with valid keys, so even fully patched WordPress sites are vulnerable.
Up to 400,000 websites may be exposed, and active exploitation is already under way.
The incident shows that credential theft can bypass the protections that patch known vulnerabilities.

Background

UpdraftPlus is one of the most widely used backup plugins for WordPress, and UpdraftCentral lets administrators manage many sites from a single dashboard. When connection keys are stolen, attackers can send commands to every site linked to an account. This breach follows a pattern of supply-chain style attacks in which trusted third-party tools become an entry point.

Key Perspectives

TeamUpdraft: The vendor says it contained the intrusion quickly, rotated affected keys, and signed out all accounts. It urges customers to update plugins and rotate storage credentials. Security researchers: Patchstack and Nethemba report active exploitation through the UpdraftCentral channel, including on current, patched software. They argue the attack's severity may rival or exceed earlier WordPress backdoor campaigns. Site administrators: They face the immediate burden of updating plugins, deleting connection keys, auditing their sites for backdoors, and restoring from clean backups if compromise is confirmed.

What to Watch

Whether TeamUpdraft's forced key rotation stops the campaign or attackers continue using keys stolen before the breach was contained.
Adoption of UpdraftPlus versions 1.26.13 and 2.26.13, and whether the bug that prevented key removal is fully resolved.
Further reporting from Patchstack and Nethemba on the scale of compromised sites and the appearance of new backdoor variants.

Sources

Stolen UpdraftCentral keys used to backdoor WordPress sites · BleepingComputer

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedNethemba said all three targeted sites ran WordPress 7.1.3 and UpdraftPlus 2.26.11, which it described as patched against CVE-2026-10795.BleepingComputer: ““All three sites ran the current WordPress 7.1.3 and UpdraftPlus 2.26.11, which is patched against the June vulnerability CVE-2026-10795,” Nethemba says .”
SupportedNethemba said the attacker came through UpdraftCentral using valid private dashboard keys, rather than breaking into its servers or exploiting a configuration weakness.BleepingComputer: ““The attacker did not break into our servers and did not exploit any weakness in our configuration. The attacker came in through the UpdraftCentral remote management channel and signed the commands with valid private dashboard keys””
SupportedStolen UpdraftCentral keys were used to backdoor WordPress sites.BleepingComputer: “According to Patchstack lead researcher Oliver Sild , attackers have begun using stolen access keys to backdoor sites connected to UpdraftCentral”
Partly supportedTeamUpdraft disclosed that an attacker gained access to its website and stole UpdraftCentral connection keys.BleepingComputer: “A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.”
Partly supportedThe summary says attacks were already under way on patched sites.BleepingComputer: “Nethemba says three of its own WordPress websites were targeted through UpdraftCentral, with malicious plugins successfully installed on two of them. “All three sites ran the current WordPress 7.1.3 and UpdraftPlus 2.26.11, which is patched against the June vulnerability CVE-2026-10795,” Nethemba says .”
SupportedSecurity researchers say attackers are using the stolen keys to install backdoors on WordPress sites, in a campaign that could affect roughly 400,000 websites.BleepingComputer: “An estimated 10% of sites using UpdraftPlus have an UpdraftCentral or Migrator key, potentially exposing around 400,000 websites to the attack. According to Patchstack lead researcher Oliver Sild , attackers have begun using stolen access keys to backdoor sites connected to UpdraftCentral”
SupportedTeamUpdraft detected unauthorised access to teamupdraft.com over the weekend of 17–18 October and closed the access route, signed out accounts, and replaced potentially affected keys and credentials.BleepingComputer: ““Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website,” TeamUpdraft said in an advisory yesterday. “Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected.””
SupportedTeamUpdraft believes the attacker accessed its customer database, which included customer and billing details, order history, password hashes, two-factor authentication settings, and connection keys.BleepingComputer: “The vendor says it believes the threat actor accessed its customer database, which included details about the customer and billing, order history, as well as more sensitive information: password hashes two-factor authentication settings connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone services”
SupportedPatchstack says attacks began on October 18 at 15:32 UTC, with attackers executing arbitrary code and adding accounts with full administrator privileges.BleepingComputer: “The WordPress plugin security company says that the attacks started on October 18 at 15:32 UTC to execute arbitrary code and add accounts with full administrator privileges.”
SupportedResearchers logged at least 99 malicious backdoor plugins with distinct names, disguised as maintenance tools such as “Site Health Cache.”BleepingComputer: “The researchers logged at least 99 malicious backdoor plugins with distinct names disguised as WordPress maintenance and optimization tools, such as “Site Health Cache.””
SupportedNethemba reported that a TeamUpdraft release intended to remove UpdraftCentral Cloud keys failed because of a bug.BleepingComputer: “Nethemba reports that the vendor's initial 1.26.12/2.26.12 release was meant to remove UpdraftCentral Cloud keys, but a bug prevented it from doing so.”
SupportedTeamUpdraft recommends updating UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later, deleting existing connection keys, and rotating storage credentials.BleepingComputer: “Users are recommended to update UpdraftPlus to 1.26.13 (free) / 2.26.13 (Premium) or later. After updating, it is recommended to log into each WordPress site and delete the UpdraftCentral connection keys from Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys.”