UpdraftCentral Keys Used to Install Backdoors on WordPress Sites
TeamUpdraft disclosed unauthorized access to its website over the weekend of October 17–18, 2026, after attackers obtained customer connection keys and used them to target WordPress sites managed through UpdraftCentral. The impact is not limited to a website-account breach: Patchstack observed an attacker using valid dashboard keys to issue commands that installed backdoor plugins on connected sites during an 18-hour period on October 18 and 19.
The potentially exposed customer database contains names, email addresses, billing addresses, order history, hashed account passwords, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft says the database does not contain financial information. It also says the UpdraftPlus plugin itself, self-hosted UpdraftCentral installations and backups sent to customers' own remote storage were not affected, although sites accessed through the hosted UpdraftCentral service require closer checks.
The attack path matters because a valid UpdraftCentral key could send commands to a connected WordPress site. Patchstack described a signed plugin.upload_plugin command delivered through the plugin's remote procedure call channel; WordPress then installed and activated the supplied plugin through its standard installer. Nethemba found backdoors that created or enabled privileged accounts, and reported that removing the plugin did not necessarily remove the account left behind.
TeamUpdraft says it closed the access route, signed users out, replaced potentially affected keys and deployed a fix. It released UpdraftPlus 1.26.13 for the free edition and 2.26.13 for Premium, which automatically disconnect every UpdraftCentral connection made before 10 p.m. BST on October 18, 2026. The vendor separately advises cloud customers to update to version 1.26.12 or later, delete the site's UpdraftCentral connection key from the WordPress dashboard and reconnect only after the checks are complete.
Administrators of affected sites should work from the site's own WordPress dashboard rather than through UpdraftCentral, inspect administrator accounts and plugins for anything unrecognised, and change administrator passwords. TeamUpdraft also recommends re-authorising remote storage and changing storage access keys as a precaution. If suspicious changes are found, its guidance says to consider restoring the site from a backup taken before October 17. Site owners should also review the listed indicators, including unexpected plugin names, unfamiliar accounts and the IP addresses 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9.