Stolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft, a WordPress backup and security plugin developer, detected unauthorized access to its infrastructure and believes a threat actor accessed its customer database, potentially compromising UpdraftCentral connection keys.
Intelligence analysis by Qwen 2.5 (3B)
A threat actor breached TeamUpdraft's website, potentially compromising UpdraftCentral connection keys that can send commands to connected WordPress sites. The breach affected around 400,000 websites using UpdraftPlus.
A bad person got into a website that helps people back up their WordPress sites. They used a secret code to make other websites do bad things. Now people need to change their passwords and check their sites for problems.
Analysis
{"heading_1":"The Breach","paragraph_1":"TeamUpdraft detected unauthorized access to its infrastructure over the weekend of October 17-18, 2026, and believes a threat actor accessed its customer database, including details about customers, billing, and sensitive information such as password hashes and two-factor authentication settings.","paragraph_2":"The breach affected around 400,000 websites using UpdraftPlus, with an estimated 10% of these sites using UpdraftCentral or Migrator keys. The breach could potentially expose these sites to unauthorized access.","paragraph_3":"The breach was detected on October 18, 2026, at 15:32 UTC, and attackers have begun using stolen access keys to backdoor sites connected to UpdraftCentral. The attackers have installed malicious backdoor plugins disguised as WordPress maintenance and optimization tools.","paragraph_4":"The breach affected three WordPress websites owned by Nethemba, which were running the current WordPress 7.1.3 and UpdraftPlus 2.26.11 versions. The attacker did not break into the servers or exploit any weaknesses in the configuration, but used the UpdraftCentral remote management channel to sign commands with valid private dashboard keys.","paragraph_5":"TeamUpdraft, Patchstack, and Nethemba recommend that users update UpdraftPlus to the latest version and delete UpdraftCentral connection keys from Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys. Administrators should inspect logs and files for indicators of compromise."}
Key points
- TeamUpdraft detected unauthorized access to its infrastructure over the weekend of October 17-18, 2026
- The breach affected around 400,000 websites using UpdraftPlus
- The breach could potentially expose these sites to unauthorized access
- Users are recommended to update UpdraftPlus to the latest version and delete UpdraftCentral connection keys from Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys
- Administrators should inspect logs and files for indicators of compromise
Users can prevent future attacks by updating their software and checking for any suspicious changes on their sites.
If the bad person gets more access, they could cause even more damage to the sites they control.
