Stolen UpdraftCentral keys used to install malicious WordPress plugins
Original title: Hackers Exploit Compromised UpdraftCentral Keys to Install Malicious Plugins on WordPress Sites
TeamUpdraft suspects an October 17-18 website breach exposed connection keys; 1.26.13 and 2.26.13 disconnect older links.
Attackers used compromised UpdraftCentral connection keys to send trusted remote-management commands and install malicious plugins on connected WordPress sites. TeamUpdraft says its website was accessed without authorization on October 17-18, 2026, and suspects its customer database was reached. The activity used valid keys rather than repeating CVE-2026-10795. Releases 1.26.13 Free and 2.26.13 Premium revoke connections made before 22:00 BST on October 18.
Unconfirmed: TeamUpdraft suspects, rather than confirming in this report, that attackers accessed its customer database.
- Wordfence reported upload commands; some attempts also tried to delete plugins.
- Only sites that already held an UpdraftCentral connection key could accept commands.
- Self-hosted UpdraftCentral, plugin packages, and third-party backups were not affected.
- Some plugins created privileged users or let attackers log in as an existing administrator.
- Emergency builds 1.26.12 and 2.26.12 were replaced after a reported issue.
Impact: malicious plugin install and possible administrator access
| Product | Affected | Fixed in |
|---|---|---|
| TeamUpdraft UpdraftPlus | sites with UpdraftCentral keys from before 22:00 BST October 18 | 1.26.13 Free and 2.26.13 Premium |
- 1.Update UpdraftPlus to 1.26.13 or later and delete remaining local UpdraftCentral keys.
- 2.Change teamupdraft.com passwords, reset two-factor authentication, and re-authorize storage keys.
- 3.Inspect plugins, Must-Use plugins, accounts, and logs; restore a pre-October 17 backup if compromised.
- Vendors
- TeamUpdraft
- Products
- UpdraftPlusUpdraftCentral
From the original article
3 min read at gbhackers.com
Attackers exploited compromised UpdraftCentral connection keys to send trusted remote-management commands to WordPress sites, ultimately installing malicious plugins that could provide unauthorized access to these websites. This incident followed unauthorized access to TeamUpdraft’s website on October 17-18, 2026.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.