What happened. In an advisory posted Oct 19, TeamUpdraft said it found unauthorised access to teamupdraft.com over Oct 17-18, closed the access route, signed out every account and replaced keys and credentials that could have been affected. It believes the attacker accessed customer, billing and order-history records. It says it stores no payment details, that UpdraftPlus plugin files and downloads were not touched, and that self-hosted UpdraftCentral is not affected.
How the backdoors land. UpdraftCentral is a remote dashboard that sends signed commands to WordPress sites. Patchstack lead researcher Oliver Sild says attacks began Oct 18 at 15:32 UTC, running arbitrary code and adding full administrator accounts through that channel. Patchstack has logged at least 99 malicious plugins with distinct names dressed up as maintenance and optimization tools, such as “Site Health Cache.” Nethemba says three of its own sites were targeted and two got the plugin, even though they ran WordPress 7.1.3 and UpdraftPlus 2.26.11, which is patched against June’s CVE-2026-10795. In its words, the attacker “signed the commands with valid private dashboard keys.”
Scale. BleepingComputer estimates about 10% of UpdraftPlus sites have an UpdraftCentral or Migrator key, which puts roughly 400,000 websites in range. Confirmed compromised sites: Undisclosed.
Why a security team should care. This is the trusted-management-plane problem in a WordPress wrapper. No vulnerability was exploited on the victim side; the attacker held keys the site was built to obey, so patch levels, WAF signatures and vuln scanners all show green. Marketing sites, regional microsites and agency-run properties are where enterprises usually run WordPress, and they are rarely in the SOC’s asset inventory. Nethemba also found that the first fix, 1.26.12 / 2.26.12, was supposed to remove UpdraftCentral Cloud keys but a bug stopped it from doing so.
What we’d do tonight. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later on every site, including ones agencies host for you. Then delete the connection keys under Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, Manage existing keys. Hunt for admin accounts and plugins created since Oct 18 15:32 UTC and check the indicators TeamUpdraft, Patchstack and Nethemba published. If you confirm a compromise, restore from a clean backup, rotate remote storage credentials, change the TeamUpdraft account password, revoke sessions and reset 2FA.