A threat actor has breached the website of TeamUpdraft, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral’s connection keys, which can send commands to connected websites.
TeamUpdraft discovered unauthorized access to its infrastructure over the weekend and believes the hacker accessed the customer database.
The developer offers several WordPress tools for backup, storage and site management:
- UpdraftPlus: Website backup and restore plugin with more than 4 million downloads
- UpdraftCentral: to remotely manage multiple locations
- UpdraftVault: for cloud backup storage
- UpdraftClone: for creating staging websites
“Over the weekend of October 17-18, we detected unauthorized access to the teamupdraft.com website.” Received TeamUpdraft in an advisory yesterday.
“Our team responded immediately and worked throughout the night to contain the issue – closing the access path, logging out all accounts, and replacing keys and credentials that may have been affected.”
The vendor believes the threat actor accessed its customer database, which contained customer and billing details, order history, and more sensitive information:
- Password hashes
- Two-factor authentication settings
- Connection key for the UpdraftCentral, UpdraftVault and UpdraftClone services
The provider said it did not store payment details and noted that UpdraftPlus plugin files and downloads were not affected. Self-hosted UpdraftCentral instances are not affected.
Although backups on the customer’s own remote storage are not affected, the company recommends that users switch storage credentials and reauthorize connections if they accessed their site through UpdraftCentral.
Huge blast radius
An estimated 10% of websites using UpdraftPlus have an UpdraftCentral or Migrator key, potentially exposing approximately 400,000 websites to the attack.
According to Patchstack’s lead researcher Oliver SildAttackers have begun using stolen access keys to backdoor sites linked to UpdraftCentral, saying the campaign may be more serious than the “wp2shell” attack.
The WordPress plugin security company says that The attacks began on October 18th at 15:32 UTC to run arbitrary code and add accounts with full administrative privileges.
Researchers logged at least 99 malicious backdoor plugins with unique names that were disguised as WordPress maintenance and optimization tools such as “Site Health Cache.”
Source: Patchstack
Although Patchstack describes an early variant of the backdoor plugin that is broken due to a coding error, a report from web application security firm Nethemba documents a newer version that allows attackers to create privileged accounts or log in as existing administrators.
According to Nethemba, three of its own WordPress websites were attacked by UpdraftCentral, with malicious plugins successfully installed on two of them.
“All three websites were running the latest WordPress 7.1.3 and UpdraftPlus 2.26.11, patched against the June vulnerability CVE-2026-10795.” Hope says.
“The attacker did not penetrate our servers or exploit a vulnerability in our configuration. The attacker entered through the UpdraftCentral remote management channel and signed the commands with valid dashboard private keys.”
Nethemba reports that the provider’s original version 1.26.12/2.26.12 was intended to remove UpdraftCentral Cloud keys, but a bug prevented this.
Users are recommended to update UpdraftPlus to 1.26.13 (Free) / 2.26.13 (Premium) or later.
After updating, it is recommended to log in to each WordPress site and delete the UpdraftCentral connection keys under Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage Existing Keys.
Administrators should examine logs and files for indicators of compromise provided by TeamUpdraft, Patchstack, and Nethemba.
If the compromise is confirmed, it is recommended to restore websites from clean backups, change the TeamUpdraft account password, revoke all sessions, and reset the two-factor authentication protection method.
