Attackers who breached backup vendor TeamUpdraft’s customer database over the weekend of October 17–18, 2026 made off with valid UpdraftCentral Cloud dashboard keys and used them to install backdoor plugins and create privileged accounts on connected WordPress sites, according to TeamUpdraft’s incident page and independent analyses.
The commands appear legitimate to affected sites because they are signed with genuine dashboard private keys, so every check inside the UpdraftPlus plugin passes. Patchstack, which tracked an 18-hour continuous campaign across October 18–19, stressed that this is a key compromise, not a code vulnerability, and that as of October 19 no plugin update alone stopped it. BleepingComputer reported that UpdraftPlus 1.26.12 and 2.26.12 were meant to revoke the exposed keys but shipped with a bug that prevented key deletion, leaving sites connected until the follow-up releases.
What happened
TeamUpdraft said unauthorized access to teamupdraft.com was resolved after it closed the access route, signed out every account and rotated exposed keys and credentials. The company believes its customer database was accessed, exposing names, email and billing addresses, order history, password hashes, two-factor settings and connection keys for UpdraftCentral Cloud, UpdraftVault and UpdraftClone. No card details were held on its systems, and the plugin code, downloads and backups in users’ own remote storage were not affected, the vendor said.
Nethemba discovered the campaign on its own infrastructure after an attacker at IP address 43.250.53.42 sent plugin.upload_plugin commands to three of its WordPress sites on October 19, successfully installing and activating malicious plugins on two of them. Those sites ran current WordPress 7.1.3 and UpdraftPlus 2.26.11 — fully patched against the earlier CVE-2026-10795 flaw — and showed no server-side intrusion. Nethemba’s analysis concluded the signing keys leaked from the UpdraftCentral Cloud environment, where they are generated and stored. Patchstack noted the same channel was abused in June via CVE-2026-10795 (CVSS 8.1), an unsigned-message flaw fixed in 1.26.5 and 2.26.5.
Security.io, citing Imunify360 telemetry, reported that signed UpdraftCentral commands tied to this campaign reached WordPress sites on more than 2,200 servers between the evening of October 18 and October 19. TeamUpdraft said the attack’s speed and the initially faulty backdoor plugins suggest the attacker used AI tooling to accelerate the campaign.
How the backdoor works
The malicious plugins hook WordPress early in each request and watch for a secret URL parameter carrying a 32-character token, according to Patchstack and GBHackers. Given the token, the plugin creates an account with a hardcoded password, assigns it the Editor role, then separately grants it manage_options and install_plugins capabilities. Because the account shows as an Editor, reviewing only the administrator list misses it, and logging in via a directly set cookie bypasses the login form, two-factor authentication and login-rate limiting.
The account survives plugin removal, and the attacker knows its password. Nethemba warned that early samples carried a coding error causing HTTP 500 errors — how the first victims noticed — and that fixing the error activates the backdoor, so the plugin must be removed, not repaired. BleepingComputer reported that the attacker later deleted the broken variant via a delete_plugin command and uploaded a working one that can create full administrator accounts or log in as existing administrators. SecNews reported probing requests on October 20 against legacy backdoor URLs on sites where the plugins had been removed, indicating continued attacker activity.
Who is affected
Any WordPress site running UpdraftPlus, free or Premium, that held an active UpdraftCentral Cloud key created before 22:00 BST on October 18 should be treated as exposed. Patchstack noted many sites may have keys without knowing it: the checkbox adding a site to UpdraftCentral during TeamUpdraft account connection is checked by default. Self-hosted UpdraftCentral installs are not affected, TeamUpdraft said.
What to do
- Update every site to UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium), which TeamUpdraft says revokes exposed cloud connection keys. WordPress.org has pushed the update automatically, but verify each site is current.
- Manually delete all UpdraftCentral keys anyway: TeamUpdraft says all connections made before 22:00 BST on October 18 are revoked, but Nethemba found 1.26.13 only removes keys created before 12:07 UTC (13:07 BST) on October 18, leaving keys created between then and 22:00 BST in place. Treat every pre-existing key as exposed and delete it from Settings > UpdraftPlus > Advanced Tools > UpdraftCentral before reconnecting.
- Log in to each site’s own dashboard, not via UpdraftCentral. Check Users for unknown accounts — including Editor-role users with elevated capabilities such as the “Site Tools” display name described by Nethemba — and remove them. Change all administrator passwords and reset two-factor authentication.
- Check the Plugins list, including Must-Use, and the plugins, mu-plugins and upgrade directories for unfamiliar plugins such as Nethemba’s “Site Health Cache” sample, which hides from the standard plugin list. Remove them rather than fixing them.
- Updating does not remove installed backdoors, created accounts or active sessions, Security.io emphasized, so a full audit is still required. Nethemba published a detection script that checks for UpdraftCentral connections, received commands, backdoor files and suspicious accounts.
- If compromise is found, consider restoring from a backup taken before October 17, and re-authorize remote storage (Google Drive, Dropbox, Amazon S3) and rotate UpdraftVault and UpdraftClone credentials as a precaution.
- All teamupdraft.com account holders should change their password and reuse it nowhere else.
Cloud keys also never expire: Cyber Kendra reported Nethemba found keys issued in November 2025 still working a year later, underscoring the need for explicit revocation. Wordify and Patchstack both say they deployed blocking rules for UpdraftCentral remote commands.
What is still unknown
No source has published a confirmed count of backdoored sites; the 2,200-server figure reflects telemetry of requests, not successful compromises. Whether the stolen keys have been invalidated on the UpdraftCentral Cloud backend, beyond the client-side revocation, remains unclear — TeamUpdraft says the issue is resolved, while Nethemba and SecNews dispute the completeness of the plugin-side fix. The attacker’s identity and infrastructure have not been attributed. Patchstack CEO Oliver Sild said on X on October 19 that the attacks were still ongoing and that some observers considered it worse than the earlier WP2Shell campaign in sites compromised.
One Response