UpdraftCentral key theft: backdoor plugins on WordPress sites

TeamUpdraft, the developer of the UpdraftPlus backup plugin and related WordPress services, suffered unauthorised access to its teamupdraft.com website over the weekend of 17–18 October 2026. According to the vendor’s advisory, as reported by BleepingComputer and CSO Online, the customer database was probably accessed, and it also held the connection keys for the UpdraftCentral, UpdraftVault and UpdraftClone services.

The problem did not stay with the vendor: according to Patchstack researchers, since 18 October attackers have been using the stolen keys to send commands to WordPress sites connected to UpdraftCentral Cloud, the service for managing multiple sites remotely, and to install backdoored plugins and administrator accounts on them.

What was exposed

According to the vendor, the customer database contained names, email and billing addresses, order history, password hashes, two-factor authentication settings and service connection keys. Card data was not stored: payments go through Stripe and PayPal.

TeamUpdraft states that the UpdraftPlus plugin files and downloads, self-hosted UpdraftCentral instances and backups kept in customers’ own remote storage (Google Drive, Dropbox, Amazon S3) were not compromised. It closed the access route, signed out every account, replaced the affected keys and credentials, including those of UpdraftVault and UpdraftClone, and added monitoring. According to CSO Online, the incident was reported to the UK ICO and other relevant authorities.

How many sites are exposed is not certain. UpdraftPlus has more than 4 million installations, but only sites with an active UpdraftCentral key can be reached through this attack. BleepingComputer, the only source to give an estimate, writes that about 10% of UpdraftPlus sites have an UpdraftCentral or Migrator key: roughly 400,000 sites.

How the attackers operate

UpdraftCentral keys are used to sign the commands that the management dashboard sends to connected sites. With valid keys, the attacker does not need to exploit any vulnerability: to the site, the commands come from the legitimate management channel.

According to Patchstack, quoted by both outlets:

• the attacks began on 18 October at 15:32 UTC;
• the commands are used to execute arbitrary code and create accounts with full administrator privileges;
• researchers counted at least 99 malicious plugins with different names, disguised as maintenance and optimisation tools, such as “Site Health Cache”;
• an early variant of the backdoor did not work because of a coding error.

Security firm Nethemba documented a newer variant that can create privileged accounts or log in as an existing administrator. Three of Nethemba’s WordPress sites were targeted through UpdraftCentral, and the malicious plugin was installed on two of them. As reported by BleepingComputer, the three sites ran WordPress 7.1.3 and UpdraftPlus 2.26.11, already patched for the June vulnerability CVE-2026-10795: the intrusion did not rely on a flaw or a misconfiguration, but on commands signed with valid dashboard keys.

CSO Online adds that some variants are designed to stay out of WordPress’s standard administration screens, and that revoking the key does not remove the plugins, accounts and active sessions created during the attack.

The sources do not publish a full list of indicators: they refer to those from TeamUpdraft, Patchstack and Nethemba.

In our reading, the relevant MITRE ATT&CK techniques are T1199 (Trusted Relationship), T1078 (Valid Accounts), T1505 (Server Software Component), T1136 (Create Account), T1036.005 (Match Legitimate Name or Location) and T1564 (Hide Artifacts).

The problem with the first fix

According to Nethemba, reported only by BleepingComputer, the first corrective release, 1.26.12 / 2.26.12, was meant to remove UpdraftCentral Cloud keys, but a bug prevented it from doing so. The versions to install are 1.26.13 (free) and 2.26.13 (Premium) or later, which according to the vendor revoke the old UpdraftCentral Cloud connections.

Impact for European and Italian organisations

UpdraftCentral is designed for those who manage many sites: web agencies, hosting providers and IT departments running several portals. For them, a single stolen key means access to every connected site. A rogue WordPress administrator can change content, read form and customer account data, and use the site to distribute malware.

For NIS2 entities this is a supply chain risk case: a third-party remote management service became the way in. If the sites process personal data, a confirmed compromise must also be assessed for GDPR breach notification. TeamUpdraft customers should also consider the password hashes and 2FA settings of their own account exposed.

What to do now

1. Take inventory of WordPress sites running UpdraftPlus and check which ones are connected to UpdraftCentral Cloud.
2. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. Do not stop at 1.26.12 / 2.26.12.
3. Manually delete any remaining keys on each site: Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys.
4. Check each site directly, not just from the dashboard: administrator accounts, installed plugins (including ones with maintenance-style names such as “Site Health Cache”), files and logs, looking for the indicators published by TeamUpdraft, Patchstack and Nethemba. Remember that some variants hide from the administration screens: check the database and file system too.
5. If you find signs of compromise, restore the site from a verified backup taken before 17 October (guidance reported by CSO Online), then change administrator passwords, terminate all sessions and check file integrity.
6. Change your TeamUpdraft account credentials and reset two-factor authentication. If a site was managed through UpdraftCentral, re-authorise the remote backup storage and change its access keys, as the vendor recommends.

How ARXDOME helps

On the servers hosting the sites, the ARX Sentry agent monitors file integrity in the chosen folders and can flag a new plugin appearing in wp-content/plugins. ARX Trace shows file changes by folder, useful for reconstructing what changed since 18 October, and ARX Shield isolates a compromised machine from the network while it is cleaned up.

Last updated: 21 October 2026