TeamUpdraft, the company behind the popular UpdraftPlus WordPress backup plugin, has disclosed a security incident in which an attacker gained unauthorized access to its website and potentially accessed sensitive customer information, including connection keys that can be used to send commands to connected WordPress sites.
The company said it detected unauthorized access to teamupdraft.com over the weekend of October 17–18, 2026. According to its security advisory, the incident prompted an immediate response, with the team closing the access route, signing out accounts and replacing credentials and keys that could have been affected.
TeamUpdraft believes the attacker accessed its customer database, which reportedly contained customer and billing information, order histories, password hashes, two-factor authentication settings and connection keys associated with UpdraftCentral, UpdraftVault and UpdraftClone.
The company said it does not store payment card details and that UpdraftPlus plugin files and downloads were not affected. Self-hosted UpdraftCentral installations were also reported to be outside the scope of the incident.
The exposure of UpdraftCentral connection keys is particularly concerning because the service allows users to manage multiple WordPress websites remotely. If attackers obtain valid keys, they may be able to abuse trusted management connections to execute commands on linked websites, potentially bypassing the need to exploit a separate vulnerability on each site.
Security researchers have reported that attackers began exploiting compromised keys on October 18, targeting websites connected through UpdraftCentral. According to Patchstack, the campaign involved attempts to execute arbitrary code and create accounts with administrator privileges.
Patchstack researchers identified at least 99 malicious backdoor plugins with different names, many disguised as legitimate WordPress maintenance, caching or optimization tools. One reported example was a plugin named “Site Health Cache,” which could appear less suspicious to an administrator reviewing installed plugins.
The malicious plugins are designed to provide attackers with continued access to compromised websites. Depending on the variant installed, this access may allow them to create privileged accounts, execute malicious code or take control of site administration.
Security firm Nethemba also documented attacks against three of its own WordPress websites through the UpdraftCentral remote management channel. The company reported that malicious plugins were successfully installed on two of the sites.
Nethemba said its affected websites were running WordPress 7.1.3 and UpdraftPlus 2.26.11, which it described as patched against the earlier vulnerability CVE-2026-10795. According to the firm’s analysis, the attacker used valid private dashboard keys to send commands through UpdraftCentral rather than breaking into the hosting servers or exploiting a separate weakness in their configurations.
The incident also raised concerns about the effectiveness of TeamUpdraft’s initial remediation. Nethemba reported that an earlier release intended to remove UpdraftCentral Cloud keys did not work as expected because of a software bug. Administrators are therefore advised to install the subsequently released versions and verify that affected connection keys have actually been removed.
The potential scale of the campaign is significant. Patchstack estimated that around 10% of websites using UpdraftPlus have an UpdraftCentral or Migrator key, potentially putting approximately 400,000 websites at risk. This is an estimate of potential exposure, not a confirmed count of compromised websites.
TeamUpdraft recommends that customers rotate credentials used for remote storage and reauthorize connections if they have managed their websites through UpdraftCentral. Although backups stored in customers’ own remote storage may remain unaffected, administrators should not assume that their websites are safe simply because their backup files are intact.
Users should update UpdraftPlus to version 1.26.13 or later for the free edition, or version 2.26.13 or later for Premium. After updating, administrators should log in to each WordPress site and navigate to Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys to remove the affected connection keys.
Administrators should also review WordPress user accounts, installed plugins, server logs and file changes for signs of unauthorized access. Any unfamiliar administrator accounts or plugins should be investigated, with particular attention paid to recently installed tools that imitate legitimate maintenance or optimization software.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
If a website is confirmed to be compromised, administrators should restore it from a known-clean backup, change their TeamUpdraft account password, revoke active sessions and reset their two-factor authentication method. They should also rotate any other credentials that may have been exposed and investigate whether attackers accessed customer information or modified website content.
TeamUpdraft Breach Exposes UpdraftCentral Keys, Putting WordPress Sites at Risk
