Compromise of WordPress sites via UpdraftCentral keys stolen from the TeamUpdraft publisher
A threat actor with valid private keys from the UpdraftCentral service remotely installed malicious plugins on connected WordPress sites, giving them full control of those sites and persistent access through a concealed account.
Description
Technical context and vulnerability details
UpdraftPlus, used on more than 4 million WordPress sites, integrates the UpdraftCentral remote management service. The sites linked to this service automatically accept orders signed by the associated private key, without additional validation. Following unauthorized access to the teamupdraft.com platform on October 17 and 18, 2026, UpdraftCentral login keys were allegedly compromised. Between October 18 and 19, 2026, the threat actor used these keys to remotely deploy malicious extensions on connected sites. These extensions act as backdoors by discreetly creating highly privileged accounts, allowing persistent access to the site while bypassing usual authentication and protection mechanisms. Even after removing the malicious extension, the created accounts remain active. The publisher indicates that it corrected the incident and released versions 1.26.13 and 2.26.13 on October 19, 2026, which automatically disable old UpdraftCentral connections established before October 18, 2026. However, the update does not remove either malicious extensions already installed or fraudulent accounts that may have been created, which makes manual verification of the affected sites essential.
Potential Risks & Impact
Potential consequences upon exploitation
- Take full control of the site and execute arbitrary code;
- Circumvention of authentication mechanisms, including double authentication;
- Persistence of unauthorized access by a hidden account surviving extension cleanup;
- Breach of confidentiality of data, both those of the sites and those of customer accounts held by the publisher;
- Compromise of system and data integrity;
- Violation of the availability of affected sites;
Affected systems
Products, components and targeted versions
- WordPress sites with an active UpdraftCentral login key created before 1u regardless of the version of UpdraftPlus installed, free or premium, including versions 1.26.11 and 2.26.11.26;
- Teamupdraft.com customer accounts, for data held by the publisher;
- Sites connected to UpdraftVault and UpdraftClone customer keys, whose identifiers have been replaced by the publisher;
- Self-hosted installations of UpdraftCentral, the UpdraftPlus extension itself and t are not affected;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update UpdraftPlus to version 1.26.13 for free edition or 2.26.13 for premium edition, or later, on all sites, including those not administered on a daily basis;
- If discovered, first delete the UpdraftCentral key, then deactivate the web extensiracine rather than deleting it from the administration interface, its uninstallation routine erasing its own traces, without correcting the fatal error it contains, this correction activating the backdoor;
- Reconnect the sites to UpdraftVault and redistribute the new UpdraftClone keys, released by the publisher;
- Only reconnect a site to UpdraftCentral after updating, and create the key under an account without install_plugins capability when remote management remains necessary;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.