Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

Stolen UpdraftCentral keys used to backdoor linked WordPress sites

7 sources · 7 articlesFirst reported Updated ()3
What's new

October 21: TeamUpdraft confirmed the weekend breach, ICO notice, and credential resets; 1.26.12 and 2.26.12 failed to clear Cloud keys, so 1.26.13 and 2.26.13 are recommended.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

TeamUpdraft’s October 17–18 breach exposed remote-management keys; attackers installed backdoors, and sites should update to 1.26.13 or 2.26.13.

TeamUpdraft says unauthorized access to teamupdraft.com on October 17–18, 2026, likely exposed customer records and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Attackers used valid UpdraftCentral keys to upload and activate backdoor plugins on linked WordPress sites from October 18 into October 19, including installs already patched for CVE-2026-10795. Patchstack logged at least 99 backdoor plugins that can create privileged users; updating or deleting keys does not remove plugins, accounts, or sessions already created. TeamUpdraft reset credentials, notified the UK ICO, and released UpdraftPlus 1.26.13 Free and 2.26.13 Premium to disconnect connections made before 22:00 BST on October 18 after 1.26.12 and 2.26.12 failed to remove Cloud keys. Self-hosted UpdraftCentral, plugin downloads, payment-card data, and customer-held backups were not affected, according to the vendor.

Key facts
  • Only sites that stored an UpdraftCentral connection key accept the remote commands.
  • UpdraftPlus has over four million active installs; BleepingComputer says about 400,000 may hold a relevant key.
  • Recommended builds are UpdraftPlus 1.26.13 Free and 2.26.13 Premium or later.
  • The backdoor can create user data-ops43 with manage_options and install_plugins rights.
  • Wordfence shipped an emergency firewall rule blocking UpdraftCentral UDRPC requests, including for free users.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 17, 2026Unauthorized access to teamupdraft.com began · Wordfence
  2. Oct 18, 2026Attackers began installing backdoor plugins at 15:32 UTC · Patchstack
  3. Oct 18, 2026Vendor cutoff set at 22:00 BST for older connections · GBHackers
  4. Oct 19, 2026Patchstack says the campaign window ended at 09:23 · Patchstack

What each outlet adds

beyond the shared facts
  • PatchstackCampaign window, HTTP 500 coding error, and backdoor persistence after plugin removal.
  • WordfenceEmergency UDRPC firewall rule released early to free customers.
  • BleepingComputerAt least 99 plugins and 1.26.12/2.26.12 failed to remove Cloud keys.
  • The Hacker NewsBackdoor looks for ?_9f5696= and can create user data-ops43.
  • CSO OnlineNethemba says three sites targeted and plugins installed on two.
Vendors
TeamUpdraft
Products
UpdraftPlusUpdraftCentralUpdraftVaultUpdraftCloneWordPress
Victims
TeamUpdraftNethemba
Organizations
PatchstackNethembaInformation Commissioner's OfficeWordfence
Countries
United Kingdom

Coverage

oldest first · one row per article · UTC
  1. · 6d ago PatchstackFirst report

    Stolen UpdraftCentral keys used to backdoor WordPress sites

    Signed commands installed backdoor plugins from October 18 to 19; no plugin update stops it, so sites must delete UpdraftCentral keys.

  2. · 6d ago Wordfence

    Stolen UpdraftCentral keys used to install malicious WordPress plugins

    TeamUpdraft says its site was accessed October 17–18 and the database held UpdraftCentral, Vault, and Clone keys.

  3. · 4d ago BleepingComputer

    Stolen UpdraftCentral keys used to backdoor WordPress sites

    TeamUpdraft says a weekend breach exposed remote-management keys; Patchstack logged backdoor plugins on connected sites.

  4. · 4d ago Cyber Security News

    TeamUpdraft breach exposed keys used to backdoor WordPress sites

    Exposed data reportedly included password hashes, billing details, and keys for UpdraftCentral, UpdraftVault, and UpdraftClone.

  5. · 4d ago GBHackers

    Stolen UpdraftCentral keys used to install malicious WordPress plugins

    TeamUpdraft suspects an October 17-18 website breach exposed connection keys; 1.26.13 and 2.26.13 disconnect older links.

  6. · 4d ago The Hacker News

    Stolen UpdraftCentral keys used to backdoor WordPress sites

    TeamUpdraft says its site was breached on October 17-18, and attackers installed backdoor plugins for about 18 hours.

  7. · 4d ago CSO Online

    Stolen TeamUpdraft keys used to backdoor connected WordPress sites

    Patchstack saw attacks from October 18 using UpdraftCentral keys to install at least 99 malicious plugin variants and create admin accounts.