Key points
- TeamUpdraft disclosed unauthorized access to its website on October 17-18, 2026.
- Compromised UpdraftCentral keys allowed attackers to execute trusted remote commands.
- Malicious plugins installed via this method could create high-privilege user accounts.
The short version
- Attackers exploited connection keys stolen from TeamUpdraft’s customer database.
- These keys let malicious commands bypass security checks on connected WordPress sites.
- Self-hosted UpdraftCentral installations and third-party backups were not affected.
The details
TeamUpdraft disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026, according to research published by Wordfence. The company suspects attackers accessed its customer database, which held account information and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. These keys are required for the remote-management dashboard to communicate with individual WordPress sites. Attackers used the exposed credentials to send trusted commands to sites that had connected to the UpdraftCentral service. Because the commands were signed with valid keys, they bypassed the plugin’s signature verification and appeared legitimate to the software.
Nethemba reported that affected sites included those running recent versions of UpdraftPlus that were already patched against CVE-2026-10795. This indicates the abuse was not a repeat of that specific vulnerability, but rather a direct exploitation of stolen credentials. Wordfence revealed that attackers issued commands to upload malicious plugins and, in some cases, delete existing ones. If the connected WordPress user had permission to install and activate plugins, the malicious code executed on the site with those same permissions.
The context
Not every installation of UpdraftPlus was vulnerable to this specific attack vector. While the remote-management client is included in both the free and premium versions of the plugin, a site must possess an active UpdraftCentral connection key to accept commands through this channel. Sites that did not connect to the central dashboard were not at risk from these stolen keys. TeamUpdraft confirmed that self-hosted installations of UpdraftCentral were not affected by the compromise of its cloud website. The company also stated that the UpdraftPlus plugin code itself, downloadable packages, and backups stored in third-party services like Google Drive, Dropbox, or Amazon S3 remained unaffected.
What to watch
The malware deployed during this incident often disguised itself as a legitimate plugin, using various names across different samples. According to GBHackers, some variants attempted to create new user accounts with elevated privileges, effectively granting attackers administrative control. Other variants allowed attackers to log in as existing administrators without creating new accounts. Users whose sites were accessed via UpdraftCentral should re-authorize remote storage connections and change their storage access keys as a precaution. No specific patch for the connection key exposure has been confirmed by the vendor beyond the recommendation to rotate credentials.
What it means for organisations
Organisations should immediately review their vendor risk posture regarding SaaS management tools. Teams usually need to verify if third-party services hold credentials that could execute code on internal assets. Security leaders should ask whether remote management keys are stored in plain text or hashed in vendor databases. Incident response plans must account for supply-chain breaches where valid credentials are stolen rather than software flaws being exploited. Internal audit teams should determine who has authority to approve remote connections and whether those connections are monitored for anomalous command patterns.
What to do and how to stay safe: UpdraftPlus
- Check if your WordPress sites are connected to UpdraftCentral or use UpdraftPlus with remote management enabled.
- Re-authorize any remote storage connections linked to your site through the UpdraftCentral dashboard.
- Change access keys for any third-party storage services like Google Drive or Dropbox used for backups.
- Monitor your site for new plugins or user accounts that you did not create or approve.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this affect all WordPress sites using UpdraftPlus?
No. Only sites connected to UpdraftCentral with an active connection key are at risk from this specific credential theft.
Was the software itself vulnerable to a new code flaw?
No. The attack used valid, stolen connection keys to bypass signature checks, rather than exploiting a bug in the plugin code.
Are my backups in Google Drive or Dropbox safe?
Yes. TeamUpdraft confirmed that backups stored directly in third-party services were not affected by the website breach.
