WordPress sites backdoored with UpdraftCentral keys
WordPress sites connected to the cloud-hosted UpdraftCentral service were backdoored after unknown threat actors obtained valid connection keys, which allow the remote service to send commands to linked websites. TeamUpdraft identified unauthorized access to teamupdraft.com over the weekend of October 17 and 18, 2026. Patchstack later observed an attacker using valid UpdraftCentral dashboard keys to install malicious plugins during an 18-hour campaign spanning October 18 and 19.
TeamUpdraft said the intruders are believed to have accessed a customer database containing names, email and billing addresses, order histories, hashed passwords, two-factor authentication (2FA) settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. A hashed password is stored as a scrambled value rather than readable text, while 2FA adds a second login check. The database did not contain payment information, which is handled by Stripe and PayPal. TeamUpdraft said the UpdraftPlus plugin itself, self-hosted UpdraftCentral installations and backups placed in customers' own remote storage were not affected.
The developer closed the access route, signed every teamupdraft.com account out and replaced credentials that could have been exposed. It also released UpdraftPlus 1.26.13 Free and 2.26.13 Premium, which automatically disconnect UpdraftCentral links established before 10 p.m. BST on October 18, 2026. TeamUpdraft separately disconnected every site from UpdraftVault, issued new credentials, replaced UpdraftClone client keys, rotated credentials used with payment providers and other connected services, added monitoring and reported the breach to the UK Information Commissioner's Office and other relevant authorities.
Cloud-hosted UpdraftCentral customers should enter each site's own WordPress dashboard rather than using the remote management service. TeamUpdraft advises updating UpdraftPlus to at least 1.26.12 Free or 2.26.12 Premium, then opening Settings, UpdraftPlus, Advanced Tools and UpdraftCentral to delete the existing connection key. Because versions 1.26.13 and 2.26.13 were released specifically to invalidate older connections, installing those releases provides the later automatic disconnection measure. Administrators should inspect the Users page for unfamiliar accounts and check both the normal Plugins page and the Must-Use tab, which contains plugins loaded automatically by WordPress. All administrator passwords should be changed. If suspicious changes appear, TeamUpdraft recommends considering a restoration from a backup made before October 17, then reconnecting the site.
Patchstack said the attacker sent a signed plugin.upload_plugin command through the plugin's remote procedure call (RPC) channel, a mechanism that lets one system instruct another over the network. The request reached the site's main address through an ordinary POST request, after which WordPress used its normal installer to install and activate the supplied plugin. Nethemba, which first detected the activity in the wild, found that the backdoor inspected every request for a particular URL parameter and compared it with a 32-character token. When the value matched, the code created an account named data-ops43 with the display name Site Tools.
That account received the Editor role but was also granted manage_options and install_plugins permissions, enabling changes to site settings and installation of arbitrary PHP plugins. Nethemba said enabling public registration and making administrator the default role would then allow creation of a full administrator. On a standard WordPress installation, an Editor can also place JavaScript in posts that runs in an administrator's browser. Removing the malicious plugin alone is insufficient because its account, protected by a password known to the attacker, remains able to use the normal login page unless 2FA is required for that account. An early version of the plugin caused affected sites to return HTTP error 500, meaning the server could not complete the request. The attacker deleted that defective plugin remotely and uploaded a working version capable of creating a full administrator or logging in as an existing one.
Indicators of compromise, meaning evidence that a site may have been altered, include plugins named Site Health Cache, Site Health 364F, Asset Forge 2, Content Helper, Wp Forge, Query Shelf, Style Bridge 8F5, Media Kit 183, Post Dock 776, Nav Hub, Speed Desk, Speed Kit 300, Link Latch, Script Shelf or Feed Case. Suspicious usernames include system_team850, web.tech988, cmseditor170, cms.tech644 and web_mgr684, often paired with an @example.com address and display names such as System Team, Web Tech, System Staff, System Ops or Cms Tech. The reported IP addresses are 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9. Patchstack counted 99 distinct backdoor plugin names, with samples containing the line "Small maintenance toolkit: keeps option storage tidy."
Wordfence said a site may be affected when UpdraftPlus Free or Premium was active while an exposed connection key was present and the site had an active link to TeamUpdraft's cloud-hosted UpdraftCentral service during the incident. Patchstack also noted an earlier flaw in the same command channel, CVE-2026-10795 with a CVSS severity score of 8.1. That vulnerability allowed commands to be forged without a key and was fixed in versions 1.26.5 and 2.26.5, although exploitation attempts reportedly continue. Sites running older releases may therefore face both weaknesses.
The incident follows a separate supply chain compromise involving Rank Math PRO, in which downloads of version 3.0.123 obtained between October 15 at 8:02 p.m. UTC and October 16 at 7:12 a.m. UTC contained backdoors. The issue, CVE-2026-111862 with a CVSS score of 9.8, was fixed in version 3.0.124. Wordfence said that malware could maintain access, contact rank1cdn[.]com, recreate hidden backdoors during page visits and expose credentials, database details, application programming interface keys and other secrets available to the web server.
Separately, the PHP Foundation released patches for CVE-2026-109618 and CVE-2026-109619, two flaws rated 9.2 that can permit code execution without authentication or reveal sensitive process memory. Information about the PHP2Shell issues leaked before their planned October 22, 11 a.m. ET disclosure, and the reported affected range covers PHP 5, 6, 7 and 8. TeamUpdraft temporarily took its support form offline because of the ongoing PHP Foundation issue and directed customers to its support forums. For website owners seeking outside management, AEU Hosting provides managed WordPress hosting, secured end to end. Regardless of hosting arrangements, affected Updraft users still need to rotate account credentials, inspect their sites and replace the exposed service connections described by TeamUpdraft.