TeamUpdraft, which develops widely-used WordPress backup and security tools, suffered a breach over the weekend of October 17–18 that exposed UpdraftCentral connection keys—credentials that allow remote command execution on connected websites. The company detected the intrusion and moved to contain it, but attackers had already accessed the customer database containing sensitive connection credentials.
TeamUpdraft's product portfolio includes UpdraftPlus (a backup and restoration plugin with over 4 million downloads), UpdraftCentral (for remote multi-site management), UpdraftVault (cloud backup storage), and UpdraftClone (for staging site creation).
Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website. Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected.
TeamUpdraft
The compromised customer database contained password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. The company clarified that payment card data was never stored and that UpdraftPlus plugin files and downloads were not affected. Self-hosted UpdraftCentral instances also remain unimpacted.
TeamUpdraft recommends that users rotate storage credentials and reauthorize connections if they accessed their sites through UpdraftCentral, even if backups stored in remote systems remain untouched.
Massive blast radius
Approximately 10% of sites running UpdraftPlus have an UpdraftCentral or Migrator key, putting roughly 400,000 websites at risk. Patchstack researchers have documented active exploitation beginning October 18 at 15:32 UTC, with attackers leveraging the stolen keys to execute arbitrary code and establish administrator-level accounts.
Patchstack lead researcher Oliver Sild noted that the campaign may exceed the severity of the earlier "wp2shell" attack. Security researchers have identified at least 99 distinct malicious backdoor plugins, many disguised as WordPress maintenance and optimization utilities with names such as "Site Health Cache."
An early backdoor variant contained a coding flaw that limited its effectiveness, but a newer iteration documented by web application security firm Nethemba enables attackers to create privileged accounts or assume control of existing administrator credentials.
Nethemba reported that three of its own WordPress installations were targeted via UpdraftCentral, with malicious plugins successfully deployed on two of them. All three sites were running WordPress 7.1.3 and UpdraftPlus 2.26.11, versions that included patches for the June vulnerability CVE-2026-10795.
The attacker did not break into our servers and did not exploit any weakness in our configuration. The attacker came in through the UpdraftCentral remote management channel and signed the commands with valid private dashboard keys
Nethemba
Nethemba discovered that TeamUpdraft's initial 1.26.12/2.26.12 release intended to remove UpdraftCentral Cloud keys contained a bug that prevented the removal from occurring.
Remediation steps
Users should upgrade UpdraftPlus to version 1.26.13 (free tier) or 2.26.13 (Premium tier) or later.
After updating, administrators should access each WordPress site and delete UpdraftCentral connection keys by navigating to Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys.
Administrators should review logs and files for compromise indicators published by TeamUpdraft, Patchstack, and Nethemba.
If compromise is confirmed, the recommended response includes restoring sites from verified clean backups, changing the TeamUpdraft account password, revoking all active sessions, and resetting two-factor authentication protection.