"Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website," TeamUpdraft said in an advisory yesterday.
TeamUpdraft confirms breach, replaces keys and credentials
TeamUpdraft, the developer behind popular WordPress tools including UpdraftPlus, UpdraftCentral, UpdraftVault and UpdraftClone, detected unauthorized access to its infrastructure over the weekend of 17–18 October and says it "responded straight away and worked through the night to contain it." The vendor stated that it closed the access route, signed out every account and replaced keys and credentials that could have been affected.
TeamUpdraft told users it believes the attacker accessed the customer database. That database, the company says, included customer and billing details, order history, password hashes, two‑factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone services. The company added that it does not store payment details, and that UpdraftPlus plugin files and downloads remain unaffected. Self‑hosted UpdraftCentral instances are not impacted, the advisory says.
Stolen UpdraftCentral keys used to backdoor sites
Researchers say the incident quickly moved from credential theft to active exploitation. Patchstack lead researcher Oliver Sild reported attackers have been using stolen access keys to backdoor sites connected to UpdraftCentral. The campaign, Patchstack wrote, began on October 18 at 15:32 UTC and was used to execute arbitrary code and add accounts with full administrator privileges.
Security firms logged dozens of malicious plugins deployed by the attackers. Patchstack recorded at least 99 malicious backdoor plugins with distinct names, often disguised as maintenance or optimization tools such as "Site Health Cache." Nethemba, a web application security firm, documented a newer backdoor variant that allows attackers to create privileged accounts or log in as existing administrators.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildScale and specific targets: roughly 400,000 sites at risk
The potential blast radius is large. An estimated 10% of sites using UpdraftPlus hold an UpdraftCentral or Migrator key — which the reporting equates to roughly 400,000 websites that could be exposed through stolen keys. Nethemba reported that three of its own WordPress websites were targeted via UpdraftCentral; malicious plugins were successfully installed on two of those sites.
Notably, Nethemba said all three of its sites ran WordPress 7.1.3 and UpdraftPlus 2.26.11, which it described as patched against the June vulnerability CVE-2026-10795. Nethemba emphasized the attacker did not exploit a configuration weakness on its servers but leveraged the UpdraftCentral remote management channel and "signed the commands with valid private dashboard keys."
Patching, key removal and recovery steps
TeamUpdraft and security researchers have provided a concise set of actions for administrators. Users are advised to update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. The vendor's earlier 1.26.12/2.26.12 release was intended to remove UpdraftCentral Cloud keys but, according to Nethemba, a bug prevented that removal.
After updating, administrators should log into each WordPress site and delete the UpdraftCentral connection keys via Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys. Teams are also urged to rotate storage credentials and reauthorize connections if sites were accessed through UpdraftCentral, and to inspect logs and files using indicators of compromise provided by TeamUpdraft, Patchstack and Nethemba.
If compromise is confirmed, recommended actions include restoring sites from clean backups, changing the TeamUpdraft account password, revoking all sessions and resetting the two‑factor authentication protection method.
What this means for technologists, site owners, and security teams
- Technologists and security teams: expect lateral movement after credential compromise — researchers note that "once attackers are using valid credentials, prevention drops sharply," a pattern the Blue Report 2026 measured across 338 million simulations. Focus incident response on detection of post‑authentication actions and rapid key revocation.
- Site owners and administrators: if you used UpdraftCentral or the Migrator key, treat stored connection keys and remote management channels as compromised until proven otherwise; update UpdraftPlus and delete remote keys from each site as instructed.
- Security operations and managed service providers: verify that client instances are not the self‑hosted UpdraftCentral type (which the vendor says are not impacted), and propagate the 1.26.13 / 2.26.13 updates and key‑rotation steps across managed estates.
The breach shows how a single compromised vendor database can be turned into a multi‑vector campaign that deploys backdoors across hundreds of thousands of sites. The immediate priority for affected administrators is to apply the vendor fixes, remove remote keys, and hunt for indicators of compromise to determine whether attackers used the stolen UpdraftCentral keys to establish persistent access.
