Hackers Exploit Compromised UpdraftCentral Keys to Install Malicious Plugins on WordPress Sites

Attackers exploited compromised UpdraftCentral connection keys to send trusted remote-management commands to WordPress sites, ultimately installing malicious plugins that could provide unauthorized access to these websites.

This incident followed unauthorized access to TeamUpdraft’s website on October 17-18, 2026. The company suspects attackers accessed its customer database, which contained UpdraftCentral connection keys and customer account information.

Malicious Plugins on WordPress Sites

UpdraftCentral allows users to manage connected WordPress sites from a single dashboard. When a site is connected, UpdraftPlus accepts commands signed with the dashboard’s trusted key and executes them with the permissions of the WordPress user who created the connection.

Wordfence revealed that attackers issued commands to upload malicious plugins; some reports also documented attempts to delete existing plugins. If the connected user could install and activate plugins, these commands could execute malicious PHP code on the site.

This activity did not simply repeat CVE-2026-10795, a previously disclosed vulnerability in the UpdraftPlus command channel. Nethemba reported that affected sites included installations running recent UpdraftPlus versions that were patched against that specific flaw.

In this incident, attackers reportedly used valid, exposed connection keys, allowing their commands to bypass the plugin’s signature checks and appear as legitimate instructions.

Not all sites running UpdraftPlus were at risk. Although the remote-management client is included in both UpdraftPlus Free and Premium versions, a site must possess an UpdraftCentral connection key to accept commands through this channel.

TeamUpdraft says self-hosted UpdraftCentral installations were not affected by the compromise of its website. Additionally, it confirms that the UpdraftPlus plugin and downloadable packages, as well as backups stored directly in third-party services like Google Drive, Dropbox, or Amazon S3, were unaffected.

However, users whose sites were accessed via UpdraftCentral should re-authorize remote storage and change their storage access keys as a precaution.

The malware may disguise itself as a regular plugin, with various plugin names reported across different samples. Some analyzed variants tried to create users with elevated privileges. In contrast, others let an attacker log in as an existing administrator without creating a new account.

In such cases, the plugin file and web server access logs could provide crucial evidence. The absence of an unfamiliar account or the site continuing to function normally does not rule out compromise.

TeamUpdraft’s current incident guidance, updated on October 20, states that UpdraftPlus versions 1.26.13 (Free) and 2.26.13 (Premium) revoke older UpdraftCentral connections.

The company indicates that connections established before 22:00 BST on October 18 have been disconnected by these releases. The company replaced earlier emergency versions 1.26.12 and 2.26.12 after a reported issue. Administrators should follow the vendor’s latest guidance and use version 1.26.13 or later.

Site owners should update UpdraftPlus from each site’s own WordPress dashboard and then check Settings > UpdraftPlus > Advanced Tools > UpdraftCentral to delete any remaining connection keys.

Removing a site from the cloud dashboard alone isn’t enough; the local key controls whether the WordPress site accepts signed commands. TeamUpdraft also advises account holders to change their teamupdraft.com passwords, update them everywhere they may have been reused, and reset two-factor authentication if enabled.

Administrators should inspect connected sites for any unexpected plugins and accounts, including Must-Use plugins, and review relevant UpdraftCentral and web server logs for suspicious commands or activities.

If you find evidence of a compromise, removing a visible plugin may not be enough; TeamUpdraft recommends restoring from a backup created before October 17. Their incident page remains the authoritative source for product-specific instructions and updates as the investigation continues.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.