UpdraftCentral Keys Stolen in TeamUpdraft Breach, Threat Actors Backdoor Thousands of WordPress Sites

TeamUpdraft, the developer behind the popular UpdraftPlus backup plugin, disclosed that attackers accessed its website over the weekend of October 17-18 and potentially harvested UpdraftCentral, UpdraftVault and UpdraftClone connection keys. Using those keys, threat actors issued remote commands that installed backdoor plugins on thousands of WordPress sites.

• Up to 400,000 sites may be vulnerable because roughly 10% of UpdraftPlus users employ UpdraftCentral or Migrator keys.
• TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to invalidate old keys and urged immediate password and 2FA resets.
• Patchstack and Nethemba documented at least 99 distinct backdoor plugins, many masquerading as maintenance tools.

How the breach unfolded

According to TeamUpdraft’s advisory, unauthorized access to the teamupdraft.com domain was detected on October 17. The company shut down the intrusion vector, signed out every account, and regenerated all credentials that could have been compromised. The vendor emphasized that the breach did not expose payment data, which is handled by Stripe and PayPal, and that the core UpdraftPlus plugin files remain untouched.

Technical details of the backdoor campaign

Patchstack researcher Dave Jong described the attackers’ workflow: valid UpdraftCentral dashboard keys were used to send a signed plugin.upload_plugin command over the plugin’s remote-procedure-call channel, which listens on ordinary POST requests to the site root. WordPress then installed and activated the supplied plugin through its standard installer.

Nethemba, the Slovakian penetration-testing firm that first spotted the activity, said the malicious plugin checks each request for a query parameter matching a 32-character token (e.g., ?_9f5696=). When a match occurs, the plugin creates a user named data-ops43 with the display name “Site Tools,” assigns the Editor role, and grants manage_options and install_plugins capabilities. Because an Editor on a default WordPress install can inject unfiltered HTML, the attacker can embed JavaScript that runs for every administrator.

The backdoor also persists after the plugin is removed: it leaves the created account with a known password, allowing login via the normal WordPress form unless two-factor authentication is enabled for that account.

Scope of impact and remediation steps

Patchstack estimates that about 10% of UpdraftPlus installations use UpdraftCentral or Migrator keys, translating to roughly 400,000 potentially exposed sites. The company observed 99 unique backdoor plugin names, each containing the line “Small maintenance toolkit: keeps option storage tidy.”

TeamUpdraft’s response includes:

1. Deploying UpdraftPlus 1.26.13 / 2.26.13, which automatically disconnects any UpdraftCentral connection made before 10 p.m. BST on October 18, 2026.
2. Signing out every teamupdraft.com account and forcing password changes, 2FA resets, and session revocations.
3. Advising users who manage sites via UpdraftCentral to re-authorize remote storage and rotate storage access keys.
4. Instructing UpdraftVault and UpdraftClone customers to generate new keys from the My Account portal and share them with clients.

Security firms recommend that site owners update to the latest UpdraftPlus version, delete any lingering UpdraftCentral keys from the Advanced Tools section, inspect logs for the signed plugin.upload_plugin and plugin.delete_plugin commands, and restore from clean backups if compromise is confirmed.

Why this matters for WordPress administrators

The incident highlights the risk of remote-management credentials being stored in a central database. Even when the core plugin is secure, a compromised management service can become a powerful attack vector, allowing threat actors to gain administrator access without exploiting a vulnerability in WordPress itself.

Organizations that rely on UpdraftCentral for managing multiple sites should audit their key rotation policies, enforce mandatory two-factor authentication for all privileged accounts, and consider limiting the default role for remote-created users. The breach also serves as a reminder that supply-chain attacks—such as the recent Rank Math PRO compromise—can compound exposure across the WordPress ecosystem.

What comes next

TeamUpdraft says it will continue monitoring for any residual activity and will issue further guidance if additional indicators emerge. Patchstack plans to publish detailed indicators of compromise to aid forensic investigations, while Nethemba will share its own detection signatures with the broader security community.

For website owners, the immediate priority is to apply the latest UpdraftPlus updates, rotate all UpdraftCentral keys, and verify that no unauthorized users exist in the WordPress user tables. Longer-term, adopting a zero-trust approach to remote management—where each site uses unique, short-lived credentials—can reduce the blast radius of any future breach.