UpdraftCentral keys enabled WordPress malware installs
UpdraftCentral connection keys exposed during unauthorized access to teamupdraft.com were used to install malicious plugins on connected WordPress websites. TeamUpdraft identified the access over October 17 and 18, 2026, and believes its customer database was accessed. The database contained credentials for UpdraftCentral, UpdraftVault and UpdraftClone, as well as customer account information. Nethemba publicly analyzed attacks using valid UpdraftCentral credentials, while Wordfence received separate reports from affected customers.
UpdraftCentral manages backups, plugins, themes, users and other WordPress functions from one dashboard. A connected site and the dashboard exchange cryptographic keys, which are secret credentials used to verify instructions. UpdraftPlus then runs correctly signed commands with the permissions of the WordPress user who created the connection. Attackers used the plugin.upload_plugin command to upload supplied plugin archives, activate malicious code and, in some cases, delete plugins. If the connected user could install plugins, the attacker could execute PHP, the programming language that runs much of WordPress, on the website.
This attack could succeed on installations containing the earlier CVE-2026-10795 fix because the requests were signed with trusted credentials and therefore passed normal authentication checks. Reports to Wordfence covered UpdraftPlus Premium 2.26.11.x and another site running UpdraftPlus Free 1.26.10 or 1.26.11. The incident does not affect every UpdraftPlus site. The remote-management client is included in Free and Premium, but it accepts UpdraftCentral instructions only when a local connection exists.
A site may be exposed if UpdraftPlus was active while a credential for TeamUpdraft's cloud-hosted service remained on the site. Installing UpdraftPlus alone does not establish that connection, although version 1.26.11 offered to add a site to UpdraftCentral when connecting a TeamUpdraft account, with that option selected by default. Owners should therefore check even if they do not remember enabling remote management. TeamUpdraft says free users without a teamupdraft.com account do not need to act. Self-hosted UpdraftCentral installations, downloadable plugin packages and backups stored in a user's own Google Drive, Dropbox, Amazon S3 or other third-party storage were not affected by the teamupdraft.com compromise.
To check, sign in directly to each WordPress dashboard, not through UpdraftCentral, then open Settings, UpdraftPlus, Advanced Tools and UpdraftCentral. A Manage existing keys entry showing one or more credentials means the site was configured to accept remote commands and should be treated as potentially exposed. In the database, the same information is stored in the updraft_central_localkeys option. Never publish its contents. An empty option or a deleted credential prevents future commands, but cannot prove that no earlier command succeeded.
TeamUpdraft released UpdraftPlus 1.26.12 Free and 2.26.12 Premium on October 19. These versions automatically disconnect UpdraftCentral connections created before 21:00 UTC, or 22:00 BST, on October 18. Update directly from each site's dashboard to either version or later. Wordfence also released an emergency firewall rule, meaning a filter that blocks specified web requests, for Free, Premium, Care and Response users. It blocks inbound UpdraftCentral UDRPC commands on Free versions through 1.26.11 and Premium versions earlier than 2.26.12. Wordfence users can obtain it through Wordfence, Firewall, All Firewall Options, Advanced Firewall Options, Rules and Manually Refresh Rules. The rule temporarily blocks legitimate cloud management commands too, but does not disrupt ordinary backups, restores or third-party backup storage.
Neither the update nor the firewall reverses an earlier compromise. Owners should delete every local UpdraftCentral connection, then preserve Central logs, web-server access logs, PHP error logs, suspicious files and records of recently modified files before removing evidence. Useful log indicators include probe.central.updraftplus.com, plugin.upload_plugin and plugin.delete_plugin. Reported network indicators include 43.250.53.42, 2a09:bac5:4e21:2e3c::49b:9 and the exact User-Agent WordPress/6.4; class-udrpc.php. Attackers can change these values, and Central retains only a limited number of events, so their absence does not establish that a site is clean.
Reported malicious plugin names included Load Stack 35C, Text Gantry Eb0, style-bridge-8f5, speed-press-23b, hero-bridge-6c9, site-health-6a20, db-works-7dba, cache-frame and site-engine. One analyzed family used the description Small maintenance toolkit: keeps option storage tidy. Some faulty samples caused HTTP 500 responses or WordPress critical-error messages, but working variants could remain less visible. Nethemba found a variant capable of hiding an administrator from the Users screen or authenticating the attacker as the first existing administrator without adding an account. Analyzed code used wp_set_auth_cookie() after hash_equals() checked a 32-character value supplied through a 12-character hexadecimal query parameter. It also used pre_user_query and pre_count_users hooks to conceal accounts.
Inspection should therefore extend beyond the Plugins and Users screens. Check wp-content/plugins, wp-content/mu-plugins, wp-content/upgrade, themes, uploads containing executable files, root files and PHP files under wp-admin and wp-includes. Review advanced-cache.php, db.php, object-cache.php and sunrise.php when present, and compare files with trusted copies. Database checks should cover effective user capabilities, sessions and application passwords, including network users and super administrators on multisite installations. Reported accounts sometimes appeared to be Editors while holding manage_options and install_plugins permissions. Indicators included the display name Site Tools, usernames such as data-ops43 or site_editor784, addresses ending in @example.org or @example.com, and option names ending in _sync_token, _uid or _installed.
TeamUpdraft says its customer database also contained names, email and billing addresses, order histories, password hashes and two-factor authentication settings. Passwords were not stored as plain text, and payment-card details were handled by Stripe and PayPal rather than stored by TeamUpdraft. Account holders should change their teamupdraft.com password from a known-clean device, replace it anywhere it was reused and reset two-factor authentication, which requires a second sign-in check. Users should also distrust unexpected requests for passwords or connection credentials.
TeamUpdraft disconnected all UpdraftVault sites and issued new credentials, so backups to that service will not resume until users reconnect it and confirm operation with a manual backup.
Also available in: Deutsch