Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites

Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote management service that's used for managing multiple sites remotely. A client component of UpdraftCentral is shipped within every copy of UpdraftPlus. "Over the weekend of 17-18 October we identified unauthorized access to the teamupdraft.com website," TeamUpdraft said in a statement. "Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected." As a result of the incident, threat actors are believed to have accessed its customer database, which holds the following information - Names, email addresses, billing addresses and order history Account passwords, stored only in hashed (scrambled) form and never in plain text Two-factor authentication (2FA) settings Connection keys for UpdraftCentral, UpdraftVault and UpdraftClone TeamUpdraft said the database does not hold any financial information, and that they are handled by Stripe and PayPal. It also emphasized that the UpdraftPlus plugin, along with self-hosted versions of UpdraftCentral and backups sent to customers' own remote storage, are not impacted. "However, if your site was accessed through UpdraftCentral, please also re-authorise your remote storage and change any storage access keys, as a precaution," it said. In addition, TeamUpdraft said it deployed a fix to address the underlying issue, signed out every teamupdraft.com account and reset login security across the site, and released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to automatically disconnect every UpdraftCentral connection made before 10 p.m. BST on October 18, 2026, to prevent the old keys from working. Other steps taken by the developer are listed below - Disconnected every site from UpdraftVault and issued new credentials Replaced every UpdraftClone client key Rotated its keys with payment providers and other connected services Implemented additional monitoring in place Reported the incident to the U.K. Information Commissioner's Office (ICO) and other relevant authorities Users who have a teamupdraft.com account are advised to change their password with immediate effect (and elsewhere, if the same password has been reused), reset 2FA settings, and exercise caution when receiving unexpected emails claiming to be from TeamUpdraft. TeamUpdraft is also recommending that cloud customers of UpdraftCentral follow the steps below as soon as possible, since the connection keys can send commands to the connected sites - Log in to the site's own WordPress dashboard, not through UpdraftCentral. Update UpdraftPlus to version 1.26.12 (free) or 2.26.12 (Premium) or later. Disconnect it from UpdraftCentral: go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete the connection key. Go to Users and check for any administrator accounts you don’t recognise. Remove them. Go to Plugins, including the Must-Use tab if you can see it, and check for anything you don’t recognise. Remove it. Change the passwords for all administrator accounts on the site. If you find anything suspicious, consider restoring the site from a backup taken before 17 October. Reconnect the site to UpdraftCentral. UpdraftVault users are being urged to reconnect their sites to the backup service, and UpdraftClone users who have created a client key are required to copy the new keys from My Account > UpdraftClone > UpdraftClone Key Management and share them with their clients. The development comes as WordPress security company Patchstack said it observed an attacker holding valid UpdraftCentral dashboard keys issuing commands to install backdoor plugins on connected WordPress sites. The campaign is said to have run continuously through an 18-hour window on October 18 and 19, 2026. "The attacker sends a signed plugin.upload_plugin command over the plugin's remote procedure call channel, which listens on ordinary POST requests to the site root. WordPress installs and activates the supplied plugin through its standard installer," Patchstack security researcher Dave Jong said. Slovakia-based penetration testing company Nethemba, which first detected the attack in the wild, has described the rogue plugin as a backdoor that hooks into every request to the site to check if the URL contains the parameter "?_9f5696=" and compares it with a 32-character token. If a matching token is detected, it creates a user "data-ops43" with the display name "Site Tools," assigns it the Editor role, and grants the account "manage_options" and "install_plugins" permissions, allowing the operator to upload arbitrary PHP plugins and open site settings. "Enabling registration and setting the default role to administrator is enough for the attacker to create a full administrator," Nethemba said. "On a standard WordPress site, an Editor also has unfiltered_html, so the account can put JavaScript into posts that runs in the browser of every administrator." "The backdoor has a second layer as well. The account it creates, with a known password, stays in WordPress even after the plugin is removed, and the attacker can log in with it through the normal login form unless two-factor authentication is enabled for that account." Although an early version of the plugin suffered from a coding error that causes impacted sites to fail with error 500, Nethemba said the threat actor deleted the broken backdoor by sending a "plugin.delete_plugin" command and then uploaded a working version that creates a full administrator account or logs in as an existing administrator. WordPress site owners are advised to check for the following indicators of compromise - Plugin names: Site Health Cache or Site Health 364F, Asset Forge 2, Content Helper, Wp Forge, Query Shelf, Style Bridge 8F5, Media Kit 183, Query Shelf, Post Dock 776, Nav Hub, Speed Desk, Speed Kit 300, Link Latch, Script Shelf, or Feed Case Account names: system_team850, web.tech988, cmseditor170, cms.tech644 or web_mgr684, with an email at @example.com and a display name such as System Team, Web Tech, System Staff, System Ops, or Cms Tech IP addresses: 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9 In all, Patchstack said it observed 99 distinct backdoor plugin names, with each sample carrying the line "Small maintenance toolkit: keeps option storage tidy." Wordfence, which published its own analysis of the incident, said a WordPress site may be affected if the below criteria are satisfied - The site had UpdraftPlus Free or UpdraftPlus Premium installed and active while the affected UpdraftCentral connection key was present. The site has, or had during the incident, an active connection key for TeamUpdraft’s cloud-hosted UpdraftCentral service. "This is the second incident in this channel in five months," Patchstack warned. "In June 2026 the vendor fixed CVE-2026-10795 (CVSS 8.1), where an obsolete unsigned message format let an attacker forge UpdraftCentral commands with no keys at all. That was fixed in 1.26.5 and 2.26.5, but exploitation attempts continue, so sites below those versions face both problems at once." The development comes days after the website of the Rank Math PRO WordPress plugin was hit by a software supply chain attack, causing users who downloaded version 3.0.123 between October 15 at 8:02 p.m. UTC and October 16 at 7:12 a.m. UTC to receive compromised versions that planted hidden backdoors. The incident has been assigned the CVE identifier CVE-2026-111862 (CVSS score: 9.8). The issue was fixed in Rank Math PRO version 3.0.124. "The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server," Wordefence said. The findings also coincide with an advisory from PHP, which said it intends to ship a security release that fixes two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS scores: 9.2), as information about the flaws leaked ahead of their scheduled disclosure. The flaws have been codenamed PHP2Shell. According to watchTowr CEO Benjamin Harris, the vulnerabilities affect PHP versions 5, 6, 7, and 8, and were originally due for release on October 22 at 11 a.m. ET. "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," Huntress said. "When a critical bug lands in PHP itself, rather than in one app built on top of it, the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.