Stolen UpdraftCentral keys used to install malicious WordPress plugins
Original title: PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites
TeamUpdraft says its site was accessed October 17–18 and the database held UpdraftCentral, Vault, and Clone keys.
TeamUpdraft disclosed unauthorized access to teamupdraft.com over the weekend of October 17–18, 2026, and believes its customer database was accessed. That database held UpdraftCentral, UpdraftVault, and UpdraftClone connection keys plus account information. Wordfence and Nethemba report attackers used valid UpdraftCentral keys to upload, activate, and delete malicious plugins on connected WordPress sites, including installs that already had the CVE-2026-10795 fix. TeamUpdraft released UpdraftPlus 1.26.12 (Free) and 2.26.12 (Premium), which disconnect connections created before the cutoff, and Wordfence shipped an emergency firewall rule.
Unconfirmed: TeamUpdraft believes the customer database was accessed; its investigation page may still be updated.
- Only sites that stored an UpdraftCentral connection key accept those remote commands.
- Reports cite installs on Premium 2.26.11.x and Free 1.26.10 or 1.26.11.
- Signed commands ran with the permissions of the WordPress user who connected the site.
- The firewall rule blocks UpdraftCentral UDRPC requests but not ordinary backups.
- Wordfence released the rule early to Free customers as well as paid plans.
Impact: Remote install and execution of malicious plugins on connected sites
| Product | Affected | Fixed in |
|---|---|---|
| TeamUpdraft UpdraftPlus | Sites with pre-incident UpdraftCentral keys; reported on Premium 2.26.11.x and Free 1.26.10 or 1.26.11 | 1.26.12 (Free), 2.26.12 (Premium) |
- 1.Update every UpdraftPlus site to 1.26.12 (Free) or 2.26.12 (Premium) or later.
- 2.In Wordfence, manually refresh firewall rules to block UpdraftCentral UDRPC requests.
- 3.Inspect connected sites and follow TeamUpdraft’s incident guidance.
- Vendors
- TeamUpdraft
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | probe.central.updraftplus.com | pdraftCentral log events. Investigate entries containing: • probe.central.updraftplus.com • Command received: plugin.uploadplugin • Command received: |
| domain | teamupdraft.com | alyzed by Nethemba included a UDRPC library version and the teamupdraft.com URL in the User-Agent. Attackers can change IP addresses an |
| ipv4 | 43.250.53.42 | ociated the campaign with the following source addresses: • 43.250.53.42 • 2a09:bac5:4e21:2e3c::49b:9 Observed malicious requests u |
From the original article
13 min read at wordfence.com
TeamUpdraft has disclosed unauthorized access to its teamupdraft. com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information.
By Alex Thomas · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.