Vulnerabilities · Application Security
Stolen keys let attackers backdoor WordPress sites via UpdraftCentral
Attackers used stolen UpdraftCentral keys to install backdoors on WordPress sites. Around 400,000 sites may be at risk. TeamUpdraft urges users to update plugins and remove old keys.
Ross GrantUpdated 2 min read
The short version
Attackers broke into the website of a company that makes popular WordPress backup tools. They stole special keys that let them control some WordPress sites from afar. Using these keys, they installed hidden software to take over sites. If you use UpdraftCentral, you should update your plugins and remove old keys right away.
By the numbers
- 4 million+WordPress sites use UpdraftPlusBleepingComputer
- 400,000Sites potentially at risk (10% of UpdraftPlus users)BleepingComputer
- 99Distinct malicious backdoor plugins observedThe Hacker News
What happened?
Attackers breached TeamUpdraft’s website and stole UpdraftCentral connection keys. They used these keys to install backdoor plugins on WordPress sites starting 18 October 2026. Around 400,000 sites may be at risk. TeamUpdraft has released updates and urged users to remove old keys and check for signs of compromise.
Who is affected
Attackers targeted WordPress sites managed with UpdraftCentral, a remote management tool from TeamUpdraft, the maker of UpdraftPlus. UpdraftPlus is a popular backup plugin with over 4 million downloads. About 10% of those sites, roughly 400,000, used UpdraftCentral or Migrator keys, making them potentially vulnerable, according to BleepingComputer (opens in a new tab).
Self-hosted UpdraftCentral instances and backups stored in users' own remote storage were not affected. The attack only impacted sites connected to TeamUpdraft’s cloud-hosted UpdraftCentral service.
What was taken
The attackers breached TeamUpdraft’s website and accessed the customer database. This database included:
- Names, email addresses, billing addresses, and order history
- Account passwords (hashed, not plain text)
- Two-factor authentication (2FA) settings
- Connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone
No payment card details were stored in the database. Payment processing was handled by third parties like Stripe and PayPal, according to The Hacker News (opens in a new tab).
How the attack worked
With stolen UpdraftCentral keys, attackers could send commands to connected WordPress sites. Security researchers at Patchstack and Nethemba found that attackers used these keys to install malicious plugins disguised as maintenance tools. At least 99 different backdoor plugins were observed, with names like “Site Health Cache” and “Asset Forge 2.”
The rogue plugins allowed attackers to create new administrator accounts or take over existing ones. In some cases, the plugin would create a user called “data-ops43” with high-level permissions, letting the attacker upload more plugins or change site settings. The attack began on 18 October 2026 and ran for at least 18 hours, according to Patchstack.
The response
TeamUpdraft responded by closing the access route, signing out all accounts, and replacing affected keys and credentials. They released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to disconnect all UpdraftCentral connections made before 18 October 2026. They also reported the incident to the UK Information Commissioner’s Office (ICO) and other authorities.
Users are urged to:
- Update UpdraftPlus to the latest version
- Delete old UpdraftCentral connection keys
- Check for unknown administrator accounts or plugins
- Change passwords and reset 2FA
- Restore from clean backups if compromise is found
What you should do
If you use UpdraftCentral or have connected your site to TeamUpdraft’s cloud services, update your plugins and delete old connection keys. Check for suspicious plugins or accounts, and change your passwords. If you find signs of compromise, restore your site from a backup made before 17 October 2026. TeamUpdraft, Patchstack, and Nethemba have published indicators of compromise to help administrators spot affected sites.
Why it matters
This attack shows how stealing a single set of credentials can let attackers control thousands of websites. It highlights the risks of centralised remote management and the importance of quickly rotating keys and updating software after a breach.
Key points
- Attackers used stolen UpdraftCentral keys to backdoor WordPress sites.
- Around 400,000 sites may be at risk if they used UpdraftCentral or Migrator keys.
- Malicious plugins created admin accounts and allowed full site control.
- TeamUpdraft released updates and urged users to remove old keys.
- Users should check for unknown plugins or accounts and restore from clean backups if needed.
Sources
BleepingComputer
Reference
- Stolen UpdraftCentral keys used to backdoor WordPress sites (opens in a new tab)
bleepingcomputer.com
- Stolen UpdraftCentral keys used to backdoor WordPress sites (opens in a new tab)
The Hacker News
Reference
