Stolen UpdraftCentral keys used to backdoor WordPress sites

TeamUpdraft, the developer behind several popular WordPress backup and security plugins, has disclosed unauthorized access to its infrastructure. The breach took place over the weekend of October 17–18, and the company believes the intruder reached its customer database.

TeamUpdraft maintains a range of tools: UpdraftPlus (backup and restoration, more than 4 million downloads), UpdraftCentral (remote management of multiple sites), UpdraftVault (cloud backup storage), and UpdraftClone (staging-site creation).

"Over the weekend of 17–18 October we identified unauthorised access to the teamupdraft.com website," the vendor said. Its team worked through the night, closing the access route, signing out every account, and replacing any keys and credentials that could have been affected.

What was exposed

Alongside customer, billing, and order details, the compromised database held password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. The company stores no payment data, and UpdraftPlus plugin files and downloads were untouched. Self-hosted UpdraftCentral instances are also unaffected.

Blast radius

Around 10% of sites running UpdraftPlus are estimated to hold an UpdraftCentral or Migrator key — roughly 400,000 websites. Patchstack lead researcher Oliver Sild reports that attackers have already begun using the stolen keys to backdoor sites, warning the campaign may prove worse than the "wp2shell" attack.

The attacks began on October 18 at 15:32 UTC, executing arbitrary code and creating accounts with full administrator rights. Patchstack logged at least 99 malicious backdoor plugins under distinct names, disguised as maintenance and optimization tools such as "Site Health Cache."

An early version of the backdoor was broken by a coding error, but security firm Nethemba documented a newer variant that can create privileged accounts or log in as existing administrators. Three of Nethemba's own sites were targeted through UpdraftCentral, with plugins successfully installed on two. All of them ran the current WordPress 7.1.3 and UpdraftPlus 2.26.11, already patched against the June flaw CVE-2026-10795. "The attacker did not break into our servers and did not exploit any weakness in our configuration. The attacker came in through the UpdraftCentral remote management channel and signed the commands with valid private dashboard keys," Nethemba said.

What to do

The initial fix (1.26.12/2.26.12) was meant to remove UpdraftCentral Cloud keys, but a bug prevented it. Users should update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later, then manually delete the connection keys in the plugin's settings. Administrators should inspect logs and files for indicators of compromise; if a breach is confirmed, restore the site from a clean backup, change the TeamUpdraft account password, revoke all sessions, and reset two-factor authentication.

Source: Bleeping Computer