Science & Tech · Cybersecurity · 6 hrs ago
Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
Attackers breached TeamUpdraft’s website, the company behind the popular UpdraftPlus WordPress backup plugin and other site-management tools.
The company believes the attackers accessed customer details, password hashes, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.
Stolen UpdraftCentral keys were used to install backdoors on connected WordPress sites, and security researchers found malicious plugins and attempts to add administrator accounts.
One estimate suggests around 400,000 websites could be exposed, though that does not mean all were attacked.
TeamUpdraft says payment details and the UpdraftPlus plugin itself were not affected, and it has replaced potentially affected keys and released updates.
Users should install UpdraftPlus 1.26.13 or later, remove old UpdraftCentral keys, check their sites for unfamiliar accounts or plugins, and change their TeamUpdraft passwords.
Unknown attackers breached TeamUpdraft’s website and may have accessed customers’ connection keys for its services.
Patchstack reported that attackers used valid UpdraftCentral keys to install backdoor plugins on connected WordPress sites.
The affected keys can send commands to sites managed through UpdraftCentral.
TeamUpdraft says it closed the access route, replaced potentially affected credentials and released updates to disconnect older UpdraftCentral connections.
The company advises affected users to update their plugins, remove unrecognised accounts and plugins, and change passwords.
- Who
- Unknown threat actors breached TeamUpdraft’s website. Patchstack reported attackers using UpdraftCentral keys to target WordPress sites.
- What
- Customer connection keys may have been compromised and used to install backdoor plugins on connected sites.
- When
- TeamUpdraft identified unauthorised access over the weekend of 17–18 October 2026. Patchstack said attacks began on 18 October at 15:32 UTC.
- Where
- TeamUpdraft’s teamupdraft.com website and WordPress sites connected through UpdraftCentral.
- Why
- Not stated
This story does not have two clearly opposing sides.
TeamUpdraft identified unauthorised access to its website over the weekend.
Patchstack said attacks began using keys to execute code and add administrator accounts.
TeamUpdraft had released UpdraftPlus versions 1.26.13 and 2.26.13 to disconnect older UpdraftCentral connections.
- UpdraftPlus installations
- More than 4 million active installations, according to The Hacker News
- Potentially exposed sites
- Around 400,000, based on BleepingComputer’s estimate
- Backdoor plugins
- Patchstack logged at least 99 malicious plugins with distinct names
- Affected update versions
- UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium)
- TeamUpdraft incident
- Unauthorized access identified over 17–18 October 2026
3 sources
What people are saying
Over the weekend of 17-18 October we identified unauthorized access to the teamupdraft.com website
the campaign may be more severe than the "wp2shell” attack
The attacker did not break into our servers and did not exploit any weakness in our configuration. The attacker came in through the UpdraftCentral remote management channel and signed the commands with valid private dashboard keys
Posts on X
These attacks are still on-going and for now there are no signs of it slowing down. Some even say it's worse than WP2Shell when it comes to how many websites are being compromised.