TeamUpdraft breach exposed keys used to backdoor WordPress sites
Original title: WordPress Backup Plugin Developer Hacked to Inject Malicious Code on Installed Sites
Exposed data reportedly included password hashes, billing details, and keys for UpdraftCentral, UpdraftVault, and UpdraftClone.
TeamUpdraft disclosed unauthorized access to teamupdraft.com on October 17-18, 2026, that likely exposed customer records and remote-management keys. Attackers used valid UpdraftCentral keys to send plugin.upload_plugin commands and load malicious PHP where the linked user could install plugins. Nethemba said affected sites already ran UpdraftPlus 2.26.11, so this was not a bypass of CVE-2026-10795. The vendor says it closed the route, signed out accounts, rotated credentials, and reported the breach.
Unconfirmed: Database access is described as likely, and Nethemba says some exposed keys may survive the update cutoff.
- Payment card details were not stored; Stripe and PayPal handled payments.
- Plugin downloads were not altered, unlike the cited GravityForms incident.
- Backdoors could hide from the plugin list or cause PHP errors and outages.
- Nethemba reports a cutoff mismatch that can leave some exposed keys in place.
- Updating or deleting keys does not remove backdoors already installed.
Impact: malicious plugins and administrator access on connected sites
| Product | Affected | Fixed in |
|---|---|---|
| TeamUpdraft UpdraftPlus | free and Premium sites with affected cloud UpdraftCentral keys | 1.26.13 Free or 2.26.13 Premium or later |
- 1.Update to UpdraftPlus 1.26.13 Free or 2.26.13 Premium or later, then delete old keys.
- 2.Change TeamUpdraft, reused, and site administrator passwords and reset two-factor authentication.
- 3.Review plugins, users, and logs; restore a backup from before October 17 if activity is found.
- Vendors
- TeamUpdraft
- Organizations
- Nethemba
From the original article
3 min read at cybersecuritynews.com
TeamUpdraft, the developer behind the UpdraftPlus WordPress backup plugin, has disclosed a website breach that exposed remote management keys. Attackers used those keys to install malicious plugins on connected WordPress sites, turning a trusted management feature into a route for running harmful code. The company identified unauthorized access to teamupdraft.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.