Attackers breached TeamUpdraft and then used stolen UpdraftCentral connection keys to take over some WordPress sites managed through the service. TeamUpdraft said its customer database was likely accessed, exposing password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Patchstack says attacks began on October 18 and used valid remote-management keys to run code and create administrator accounts; users should update UpdraftPlus to 1.26.13 or 2.26.13 or later because 1.26.12/2.26.12 did not fully remove cloud keys.
Why it matters: This is urgent for WordPress site owners because the attacker did not need to break into each site separately; stolen vendor keys could be used to plant backdoors and admin accounts remotely. Organizations using UpdraftCentral should update immediately, remove old connection keys, review logs and plugins for signs of compromise, and rotate related credentials.
Bill Toulas
2026.10.21
100% relevant
This article establishes the underlying event: a breach of TeamUpdraft that exposed UpdraftCentral keys and led to active backdooring of connected WordPress sites.
← Back to all stories