UpdraftCentral Keys Exploited to Install Backdoors in WordPress
The TeamUpdraft breach may have exposed UpdraftCentral cloud keys. Independent analyses recorded their use to remotely install malicious plugins on connected WordPress sites.
Compromised UpdraftCentral keys were used to remotely install malicious plugins with backdoors on some WordPress sites. TeamUpdraft confirmed unauthorized access to teamupdraft.com during the weekend of October 17–18, 2026. According to the company, the customer database may have been exposed, including keys for the UpdraftCentral, UpdraftVault, and UpdraftClone services.
The incident does not affect all users of the UpdraftPlus plugin. The risk applies to installations with an UpdraftCentral cloud connection, whose keys allow commands to be sent to connected WordPress sites. An attacker who obtained such a key could use the trusted remote-management channel to upload a plugin and establish persistent access to the site.
Compromised UpdraftCentral keys and the plugin-upload command
Security companies Nethemba and Patchstack independently documented the abuse of validly signed plugin.upload_plugin commands. These commands were used to deploy malicious plugins containing backdoors on connected sites.
Importantly, this is not a confirmed flaw in UpdraftPlus code, nor does it involve modified installation packages for the plugin. TeamUpdraft stated that the UpdraftPlus distribution packages themselves were not affected by the incident. The company also claims that self-hosted UpdraftCentral deployments are not affected.
This scenario complicates standard WordPress security checks: an administrator may have been using an up-to-date, unmodified plugin, yet the site could still have been compromised through an active cloud connection. An uploaded malicious plugin can serve as a backdoor, meaning a mechanism for further unauthorized access.
Update revokes older connections
TeamUpdraft released UpdraftPlus versions 1.26.13 and 2.26.13. According to the provider, this update automatically revokes old UpdraftCentral connections created before October 18, 2026, 22:00 BST. The aim is to block the use of older keys that may have been exposed during the incident.
Administrators of affected cloud-connected sites should therefore verify the installed UpdraftPlus version and upgrade to version 1.26.13 or 2.26.13. The update itself will not remove a malicious plugin that may already have been installed on the site, nor any unauthorized administrator accounts that may have been created. If compromise is suspected, installed plugins and WordPress user accounts should be reviewed.
TeamUpdraft reported the incident to the UK ICO and other relevant authorities. However, it has not publicly disclosed the technical cause of the unauthorized access or definitively confirmed which specific database records were exfiltrated.
The number of affected sites is not yet known
It has not been publicly confirmed how many WordPress sites were attacked, what the extent of the attackers’ subsequent access was, or the complete list of backdoors used. The situation after the fix also remains unclear: TeamUpdraft claims that revoking old connections blocked this vector, while Nethemba recorded continued attempts to send commands.
Continued attempts alone do not confirm successful compromise of already updated sites. Further information should come from the results of TeamUpdraft’s investigation, any notifications to affected users, and technical indicators from security providers or hosting companies.
Sources
- TeamUpdraft – Confirms unauthorized access, possible exposure of the database and keys, the release of versions 1.26.13/2.26.13, revocation of old connections, and recommended remediation steps.
- Patchstack – Documents the abuse of valid UpdraftCentral keys to deploy backdoor plugins and characterizes the incident as a key compromise, not an UpdraftPlus code flaw.
- Nethemba – Provides technical evidence from its own compromised sites, including records of the `plugin.upload_plugin` command and an analysis of the backdoors.
- BleepingComputer – Independently summarizes the confirmed TeamUpdraft incident and the possible abuse of the keys for remote commands.
Verified and updated: October 21, 2026 15:41
