"Over the weekend of 17-18 October we identified unauthorized access to the teamupdraft.com website," TeamUpdraft said in a statement.
TeamUpdraft breach and the company's immediate response
TeamUpdraft — the developer of the UpdraftPlus WordPress backup plugin — disclosed that unknown actors breached teamupdraft.com and are believed to have accessed its customer database. The vendor said the database may contain names, email addresses, billing addresses, order history, account passwords stored only in hashed form, two-factor authentication (2FA) settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. TeamUpdraft said the database does not hold financial information, which it said is handled by Stripe and PayPal.
To contain the incident the company said it closed the access route, signed out every teamupdraft.com account, replaced keys and credentials that could have been affected, rotated keys with payment providers and other connected services, disconnected every site from UpdraftVault and issued new credentials, replaced every UpdraftClone client key, deployed a fix, and implemented additional monitoring. TeamUpdraft reported the incident to the U.K. Information Commissioner's Office (ICO) and other relevant authorities.
How attackers used UpdraftCentral keys to install backdoors
Security vendor Patchstack reported that attackers holding valid UpdraftCentral dashboard keys issued commands to install backdoor plugins on connected WordPress sites. Patchstack researcher Dave Jong said the attacker sends a signed plugin.upload_plugin command over the plugin's remote procedure call channel, which listens on ordinary POST requests to the site root; WordPress then installs and activates the supplied plugin through its standard installer.
Patchstack observed the campaign running through an 18-hour window on October 18 and 19, 2026. In response, TeamUpdraft released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) to automatically disconnect every UpdraftCentral connection made before 10 p.m. BST on October 18, 2026.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildNethemba and Wordfence: what the backdoors did and how to spot them
Slovakia-based penetration testing company Nethemba, which first detected the attack in the wild, described the rogue plugin as a backdoor that hooks into every request to the site to check for a URL parameter named "?_9f5696=" and compare it with a 32‑character token. When a matching token is detected, the plugin creates a user "data-ops43" with the display name "Site Tools," assigns the Editor role, and grants the account manage_options and install_plugins permissions — enabling the operator to upload arbitrary PHP plugins and open site settings.
Nethemba warned that because an Editor on a standard WordPress site has unfiltered_html, the account can place JavaScript into posts that runs in the browser of every administrator. The researchers also said the backdoor has a second layer: the account it creates, with a known password, can remain after the plugin is removed and allow normal-login access unless 2FA is enabled for that account.
Wordfence laid out criteria for affected sites: the site had UpdraftPlus Free or Premium installed and active while the affected UpdraftCentral connection key was present, and the site has, or had during the incident, an active connection key for TeamUpdraft’s cloud-hosted UpdraftCentral service.
Patchstack said it observed 99 distinct backdoor plugin names, each carrying the line "Small maintenance toolkit: keeps option storage tidy." Indicators of compromise listed by analysts include plugin names such as Site Health Cache, Asset Forge 2, Wp Forge, Script Shelf, and many others; suspicious account names such as system_team850, web.tech988, cmseditor170, cms.tech644 or web_mgr684 using @example.com emails and display names like System Team or Web Tech; and IP addresses 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9.
Actions TeamUpdraft and site administrators are taking
TeamUpdraft said it signed out every teamupdraft.com account and reset login security across the site. It instructed users with a teamupdraft.com account to change their password immediately, reset 2FA settings, and be cautious of unexpected emails claiming to be from TeamUpdraft.
The developer urged cloud customers of UpdraftCentral to take specific steps: log into the site's WordPress dashboard (not via UpdraftCentral), update UpdraftPlus to version 1.26.12 (free) or 2.26.12 (Premium) or later, disconnect the site from UpdraftCentral via Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete the connection key, inspect Users for unknown administrator accounts and remove them, check Plugins (including the Must-Use tab) for unfamiliar items and remove any, change all administrator passwords, and, if anything suspicious is found, consider restoring the site from a backup taken before 17 October. Once cleaned, sites may reconnect to UpdraftCentral. UpdraftVault users were urged to reconnect to the backup service, and UpdraftClone clients were required to copy new keys from My Account > UpdraftClone > UpdraftClone Key Management and share them with their clients.
Concurrent threats: Rank Math PRO and PHP advisories
The UpdraftCentral exploitation unfolded days after the Rank Math PRO plugin suffered a supply chain attack that delivered backdoored versions between October 15 and 16, 2026; that incident has been assigned CVE-2026-111862 (CVSS 9.8) and was fixed in Rank Math PRO version 3.0.124. Wordefence said the Rank Math malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose credentials and secrets accessible to the web server.
Separately, PHP issued an advisory that it intends to ship a security release for two critical vulnerabilities codenamed PHP2Shell — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) — after information about the flaws leaked ahead of scheduled disclosure. The convergence of remote-management key abuse, supply-chain compromise, and a looming critical PHP release underscores multiple, distinct vectors that can lead to persistent server-side access.
TeamUpdraft has reset keys, issued updates to sever old UpdraftCentral links, and notified regulators; site owners who use TeamUpdraft services now face a narrow, concrete set of actions — disconnect, inspect, and rotate — to cut the attacker out of remote management channels. Whether those steps will halt follow-on exploitation attempts across the many sites and plugin ecosystems affected remains the immediate question.
