Stolen UpdraftCentral keys used to plant backdoors on WordPress sites

Attackers are using UpdraftCentral connection keys stolen from TeamUpdraft, the developer of the popular UpdraftPlus backup plugin, to install backdoors on WordPress sites, BleepingComputer reports. TeamUpdraft detected unauthorized access to its teamupdraft.com website over the weekend of October 17-18, and security firms say attacks on customer sites began within hours.

What happened

According to BleepingComputer, TeamUpdraft believes the attacker accessed its customer database, which contained billing details, order history, password hashes, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company says no payment details were stored, that UpdraftPlus plugin files and downloads were not affected, and that self-hosted UpdraftCentral instances are not impacted. The report does not describe how the attacker gained access.

TeamUpdraft said it closed the access route, signed out all accounts and replaced keys and credentials that could have been affected.

Technical details

UpdraftCentral is a remote management dashboard for WordPress sites. BleepingComputer reports that the attackers use the stolen keys to send signed commands through this management channel, allowing them to execute arbitrary code and create administrator accounts.

Patchstack told BleepingComputer that attacks began on October 18 at 15:32 UTC and that it has logged at least 99 malicious backdoor plugins with distinct names, disguised as maintenance or optimization tools such as "Site Health Cache." Patchstack describes an early backdoor variant that is broken by a coding error.

Security firm Nethemba said three of its own WordPress sites were targeted through UpdraftCentral and malicious plugins were installed on two of them. All three ran WordPress 7.1.3 and UpdraftPlus 2.26.11, which is patched against CVE-2026-10795, showing the attacker relied on valid keys rather than a software flaw. Nethemba describes a newer variant that can create privileged accounts or log in as existing administrators. It also reported that the vendor's initial fix in versions 1.26.12/2.26.12, meant to remove UpdraftCentral Cloud keys, did not work because of a bug.

Who is affected

According to the report, about 10% of UpdraftPlus sites have an UpdraftCentral or Migrator key, potentially exposing around 400,000 websites. Sites connected to TeamUpdraft's hosted UpdraftCentral service are at risk; self-hosted dashboards are not.

What to do

• Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later.
• Delete UpdraftCentral connection keys under Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, Manage existing keys.
• Review logs, plugin lists and administrator accounts using indicators published by TeamUpdraft, Patchstack and Nethemba.
• Rotate storage credentials and reauthorize remote storage connections.
• If compromise is confirmed, restore from a clean backup, change the TeamUpdraft account password, revoke all sessions and reset two-factor authentication.