A breach of the vendor’s own website handed attackers the keys to other people’s WordPress sites. TeamUpdraft, the company behind the UpdraftPlus backup plugin, said it identified unauthorized access to teamupdraft.com over the weekend of Oct. 17-18, 2026, and security researchers say attackers then used UpdraftCentral connection keys to install backdoor plugins on sites linked to the remote-management service. Patchstack logged the first backdoor installation on Oct. 18 at 15:32.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
BleepingComputer, which reported the campaign on Oct. 20, said about 10% of UpdraftPlus sites have an UpdraftCentral or Migrator key, which would put roughly 400,000 websites in the exposed pool. That is an estimate of exposure, not a count of compromised sites, and no source gives a total of sites actually backdoored. Patchstack puts UpdraftPlus at more than four million active installations, which is why even a small share of connected sites adds up to a large absolute number.
What TeamUpdraft says was taken
In its incident notice, written by Joe Whittaker and last updated on Oct. 22, TeamUpdraft says it believes the attacker accessed its customer database. That database holds names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company says card details were never stored, because Stripe and PayPal handle payments, and that the UpdraftPlus plugin, its downloads and backups kept in customers’ own remote storage were not affected. Self-hosted UpdraftCentral is not affected either.
The company closed the access route, signed out every teamupdraft.com account, disconnected all sites from UpdraftVault with new credentials, replaced UpdraftClone client keys and rotated keys with payment providers. It also brought in an outside security firm, contacted police and reported the incident to the ICO and other authorities. In the Oct. 22 update the company said it suspects the attacker used AI to speed up the attack, which it presents as suspicion rather than a confirmed finding.
How the keys became backdoors
UpdraftCentral lets an administrator push commands to many WordPress sites from one dashboard, and each connected site holds a key that authorizes those commands. Patchstack security research lead Dave Jong wrote on Oct. 19 that this is a key compromise rather than a code flaw, so it has no CVE and no plugin patch could have stopped it at that point. The commands were signed with genuine dashboard private keys, so every check the plugin performs passed. Patchstack said the keys likely leaked from the UpdraftCentral Cloud environment, and TeamUpdraft had not yet explained the cause when that article went up.
Patchstack recorded 99 distinct names for the malicious plugins, many posing as maintenance tools, with “Site Health Cache” the most common. Jong described the working backdoor as one that watches every request for a secret URL parameter and, when it sees the token, creates a hidden account with the Editor role and then grants it permission to manage options and install plugins. It sets a login cookie directly, so the login form, two-factor authentication and login-protection plugins are all bypassed, and the account survives removal of the plugin. Patchstack lists two sample IP addresses, 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9, as a starting point only.
BleepingComputer’s coverage of the campaign cites Oliver Sild, a lead researcher at Patchstack, who said in a post on X that attackers had begun using the stolen keys and that the campaign could prove more severe than the earlier wp2shell attacks, which installed web shells on WordPress sites.
What Nethemba saw, and what site owners were told to do
The security firm Nethemba found the attack on its own sites in the early hours of Oct. 19. Its analysis, written by Pavol Lupták, says three of its WordPress sites were targeted through UpdraftCentral, and two were backdoored while the third failed on permissions. The sites ran WordPress 7.1.3 and UpdraftPlus 2.26.11, already patched against CVE-2026-10795, a June forged-command flaw in the same channel. Nethemba concluded the fault was not on its side of the connection, since the attacker used valid keys. It also reported that its first backdoor variant crashed the host site because of a coding error, while a later variant logs in as an existing administrator and may leave little trace in the database.
Fixed releases are UpdraftPlus 1.26.13 for the free plugin and 2.26.13 for Premium, published on Oct. 19. Nethemba warns against stopping at 1.26.12 or 2.26.12, because a bug kept those builds from deleting the leaked keys. Nethemba also cautions that even the 13 releases do not remove keys created on Oct. 18 between 12:07 and 21:00 UTC, so owners should delete every UpdraftCentral key by hand in the plugin’s Advanced Tools tab, even where no backdoor is found.
Both Patchstack and TeamUpdraft advise treating any site with a confirmed backdoor as fully compromised: restore from a backup taken before Oct. 17, review user accounts and plugins, rotate administrator passwords, and end all sessions. Patchstack also suggests holding off on reconnecting to UpdraftCentral until the vendor explains how the keys were obtained.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
