Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites After TeamUpdraft Breach

Attackers breached TeamUpdraft, took UpdraftCentral connection keys and used them to push backdoor plugins to connected WordPress sites. Here's how to check yours and clean it up.

4T4Tify Team4Tify
Oct 21, 2026·5 min read
Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites After TeamUpdraft Breach

Stolen UpdraftCentral Keys Used to Push Backdoors to WordPress Sites

A breach at TeamUpdraft, the company behind the UpdraftPlus backup plugin, has turned a trusted remote-management channel into a delivery route for malware. Attackers who got into the vendor's website walked away with connection keys for its cloud services, then used them to install backdoor plugins on WordPress sites that had those connections in place.

What happened

TeamUpdraft says it spotted unauthorised access to teamupdraft.com over the weekend of 17–18 October 2026. The exposed customer database held names, email and billing addresses, order history, hashed account passwords, 2FA settings and, most importantly, connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The vendor states that no payment card data was held (payments go through Stripe and PayPal) and that the UpdraftPlus plugin itself, self-hosted UpdraftCentral and backups stored in customers' own remote storage were not affected.

UpdraftCentral is a remote dashboard for managing many WordPress sites at once, and its client component ships inside every copy of UpdraftPlus, which has more than four million active installs. A valid key lets the holder send signed commands to a connected site. Over an 18-hour window on 18–19 October, an attacker with valid keys did exactly that: they sent a plugin-upload command over the plugin's remote-call channel, and WordPress installed and activated the attacker's plugin as if an administrator had done it.

The rogue plugin waits for a request with a secret URL parameter and token. When it gets one, it creates a hidden Editor account with extra rights (manage_options, install_plugins). That is enough to upload arbitrary PHP, change site settings, or turn on open registration with administrator as the default role. Because Editors can post unfiltered HTML, the account can also plant JavaScript that runs in every administrator's browser. Removing the plugin does not remove that account; it stays, with a known password, until someone deletes it. An early, buggy build crashed sites with HTTP 500 errors. The operator then deleted it remotely and pushed a working version that creates a full administrator account. Researchers counted 99 distinct backdoor plugin names.

Why it matters

Patching doesn't help with this one. No vulnerability was exploited on the victim sites; the attacker used legitimate, signed commands from a service the site owner had chosen to trust. Any "manage all your sites from one place" tool works the same way: if the vendor is breached, every connected site is exposed. It is also the second problem in this channel in five months. CVE-2026-10795 (CVSS 8.1), fixed in UpdraftPlus 1.26.5 / 2.26.5 in June, let attackers forge UpdraftCentral commands without any key, and exploitation attempts are still being seen. Sites on older versions are exposed to both issues.

What to do

You are likely affected if UpdraftPlus (Free or Premium) was active on a site that had a connection key for the cloud-hosted UpdraftCentral service during the incident. If so:

  1. Log in directly to the WordPress dashboard, not through UpdraftCentral.
  2. Update UpdraftPlus to 1.26.13 (Free) / 2.26.13 (Premium) or later. These releases cut every UpdraftCentral connection made before 22:00 BST on 18 October so the old keys stop working.
  3. Delete the old connection key under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral.
  4. Audit users. Remove any administrator or editor you don't recognise, especially accounts such as data-ops43 ("Site Tools"), system_team850, web.tech988, cmseditor170, cms.tech644 or web_mgr684, or accounts with an @example.com email.
  5. Audit plugins, including the Must-Use tab. Known backdoor names include Site Health Cache, Site Health 364F, Asset Forge 2, Content Helper, Wp Forge, Query Shelf, Style Bridge 8F5, Media Kit 183, Post Dock 776, Nav Hub, Speed Desk, Speed Kit 300, Link Latch, Script Shelf and Feed Case. Look for the description line "Small maintenance toolkit: keeps option storage tidy."
  6. Check logs for traffic from 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9.
  7. Rotate all admin passwords and turn on 2FA for every privileged account. 2FA stops the leftover backdoor account from logging in through the normal login form.
  8. If you find anything suspicious, restore from a backup taken before 17 October, then reconnect to UpdraftCentral.
  9. UpdraftVault / UpdraftClone users: reconnect your sites and pick up the newly issued keys. If your site was managed through UpdraftCentral, also re-authorise your remote storage and rotate its access keys.
  10. teamupdraft.com account holders: change your password, and change it anywhere else you reused it. Reset 2FA, and treat unexpected "TeamUpdraft" emails as possible phishing.

A plugin you never installed, an outdated plugin version, or an admin account nobody can explain are the kinds of things vulnerability scanning is built to find. Our team runs authenticated and external WordPress scans that check plugin versions against known CVEs and flag unexpected components, so issues like these are caught early instead of after the fact.

Background reporting: The Hacker News. Technical details draw on public statements and analyses from TeamUpdraft, Patchstack, Nethemba and Wordfence.

SHARE