UpdraftCentral key theft enables WordPress site takeovers
UpdraftCentral key theft is enabling an attacker to install malicious software on connected WordPress sites using instructions that the sites accept as legitimate. Patchstack reported that the campaign ran continuously during an 18-hour period on 18 and 19 October 2026, with the first installation recorded at 15:32 on 18 October and the most recent at 09:23 the next day. Nethemba initially detected the activity on its own infrastructure, analysed it and reported the incident to TeamUpdraft while the campaign was still running.
UpdraftPlus is a WordPress backup plugin, meaning a software extension added to a website, with more than four million active installations. UpdraftCentral is a separate remote-management service whose client is included in free and premium copies of UpdraftPlus. Only sites holding an active UpdraftCentral key are exposed, but that includes every UpdraftPlus version, including releases 1.26.11 and 2.26.11.26. Patchstack said at 08:00 UTC on 19 October that exploitation remained active and no vendor fix existed. TeamUpdraft published a security incident post at 13:00 UTC describing what had happened and its actions so far.
This is a credential compromise rather than a software vulnerability, so it has no CVE identifier and no plugin update stops the attack. When a site is connected, it generates an RSA key pair, two mathematically linked digital credentials used to verify instructions, and stores the dashboard's public key. The corresponding private key remains in the UpdraftCentral Cloud service. Any command carrying a valid signature from that private key runs with the permissions of the user who established the connection, without anyone approving each individual instruction.
A key can be created by connecting a site directly to an UpdraftCentral dashboard. It can also be created when connecting a TeamUpdraft.com account. That account screen includes an option to add the website to UpdraftCentral for centralised control of up to five sites, and the option is selected by default. It appears only when a site does not already have a key. Consequently, some websites may hold active credentials even if their owners used UpdraftPlus only for backups and did not deliberately adopt remote management. Patchstack found that credentials issued in November 2025 were still working in October 2026 because they do not expire.
The attacker sends a correctly signed plugin.upload_plugin command through the remote procedure call channel, a mechanism that lets one system instruct another over a network. It arrives as an ordinary POST request, which is a standard way of sending information to a website, at the site's main address. WordPress then installs and activates the supplied plugin through its normal installer. No separate login is needed because the stolen dashboard credentials pass the plugin's authentication checks.
Nethemba found that affected sites had official UpdraftPlus files, unchanged credential fingerprints across several days of backups, working cryptography and no logged unauthorised administrator or conventional plugin upload. The hostile requests also originated outside the vendor's infrastructure and lacked the library version and URL carried by normal dashboard traffic. According to Patchstack, this evidence points to credentials leaking from the UpdraftCentral Cloud environment. TeamUpdraft had not provided an explanation when Patchstack's initial article went live.
Each installed plugin contains a backdoor, a concealed method for regaining control of a website. It examines every request for a secret address parameter containing a 32-character token. When that token is supplied, the code creates a WordPress account with a fixed password and labels it as an Editor. It then separately gives the account manage_options and install_plugins, permissions that allow changes to important settings, installation of executable plugin code and promotion to full administrator access. The backdoor logs the visitor in by placing a persistent browser cookie directly and redirects to wp-admin. This avoids the normal login screen, so two-factor authentication, login-attempt limits and login-protection plugins are not invoked.
Removing the malicious plugin alone does not remove the account or its known password. The analysed samples also contained a programming error that caused an HTTP 500 response, an error showing that the website could not process a request, before the secret-token check ran. This made every uncached page fail and helped some victims notice the problem within minutes. Site owners should not repair the faulty code because doing so activates the backdoor. They should remove it safely instead.
Patchstack recorded installations across a broad range of sites. Some plugins were installed but not activated, apparently because the account that created the UpdraftCentral connection lacked permission to activate them; those sites should still be treated as affected. Requests came from 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9, but the infrastructure changed within a day, making address blocking ineffective. Researchers observed 99 plugin names. “Site Health Cache” appeared repeatedly, while most others were random two-word or three-word combinations. Every sample used the description “Small maintenance toolkit: keeps option storage tidy.”
The malicious account is hidden among Editors rather than administrators. Confirmed usernames include data-ops43 and media-staff96, but other names should be expected. Supporting indicators include two words followed by two digits in the username, an address ending in @example.org, the display name “Site Tools” and a database option ending in _sync_token. UpdraftCentral logs may show probe.central.updraftplus.com followed by Command received: plugin.upload_plugin. Unrecognised plugin error emails or installations without a matching administrator action are also warning signs.
Administrators can check for exposure with `wp option get updraft_central_localkeys`; any output means a credential is stored. In the WordPress dashboard, it can be removed through Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, then “Manage existing keys” and delete every entry. The command-line alternative is `wp option delete updraft_central_localkeys`. Removing a website only from the remote dashboard is insufficient because the relevant credential remains stored on the site. Deleting it stops remote management but does not stop scheduled backups. Patchstack advises against reconnecting until the cause has been explained.
If a backdoor is present, delete the UpdraftCentral credential first to prevent the attacker from sending a corrected replacement. Deactivate the plugin and move it outside the web-accessible folder rather than deleting it through wp-admin, because its uninstall routine removes traces. Delete the associated account and _sync_token option.