Critical Vulnerability in UpdraftPlus WordPress Plugin Exposes 3 Million Sites

Key Takeaways

• A breach at TeamUpdraft exposed remote management keys for the UpdraftPlus WordPress plugin.
• Attackers leveraged these keys to install malicious plugins on connected WordPress sites, potentially affecting millions of users.
• The vulnerability exploited valid management commands, not a flaw in the UpdraftPlus plugin itself.
• Users are urged to update UpdraftPlus to versions 1.26.13 Free or 2.26.13 Premium (or later), delete old UpdraftCentral connection keys, and change passwords.

TeamUpdraft, the company behind the widely used UpdraftPlus WordPress backup plugin, has confirmed a security incident involving its website, teamupdraft.com. The breach led to the compromise of remote management keys, which attackers subsequently utilized to deploy malicious plugins on WordPress sites linked via UpdraftCentral.

The unauthorized access to teamupdraft.com occurred between October 17 and 18, 2026. During this period, attackers likely gained entry to the company’s customer database, potentially exposing sensitive information such as names, email addresses, billing details, order histories, hashed passwords, two-factor authentication configurations, and, critically, connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone services.

Attackers Exploited Stolen Keys to Install Malicious WordPress Plugins

UpdraftCentral provides a centralized dashboard for administrators to manage multiple WordPress sites. This system operates on a trust model where connected sites execute commands signed with the dashboard’s private key, inheriting the permissions of the WordPress user who established the connection.

Researchers at Nethemba detailed how attackers successfully used valid keys to send the plugin.upload_plugin command. If the linked WordPress user possessed the necessary permissions to install and activate plugins, the malicious PHP code was accepted and loaded. In one instance examined by Nethemba, the attempt failed because the associated user account lacked these specific installation privileges.

It is important to note that this incident did not involve bypassing the earlier CVE-2026-10795 security fix. The affected sites investigated by Nethemba were already running UpdraftPlus version 2.26.11. Instead, the stolen keys allowed attackers to pass normal security checks, circumventing the need to exploit any existing software vulnerabilities.

The backdoors discovered by researchers were often disguised as legitimate maintenance tools. Functional variants of these backdoors could either log attackers into existing administrator accounts or create new ones. Some were designed to remain hidden from the standard plugin list, while others were poorly implemented, leading to PHP errors and website outages. Consequently, a clean administrator list is not sufficient proof that a site has not been compromised.

Both free and Premium users of UpdraftPlus are potentially at risk if their sites had active UpdraftCentral connection keys stored in the cloud. Simply installing UpdraftPlus does not automatically create these connections. However, linking a TeamUpdraft account can present an option to add the site to UpdraftCentral, making it crucial for users to review and verify any existing connections.

TeamUpdraft has clarified that the UpdraftPlus plugin itself and its official download packages were not compromised or altered. This differentiates the incident from supply chain attacks like the one seen with GravityForms, where malicious code was distributed through compromised downloads. Earlier security exposures related to UpdraftPlus backups also stemmed from a separate plugin vulnerability, not from stolen cloud management keys.

The vendor also confirmed that self-hosted UpdraftCentral instances and backups stored by customers in their own Google Drive, Dropbox, or Amazon S3 accounts were not impacted by the website breach. Nonetheless, sites accessed through UpdraftCentral are advised to renew their storage access as a precautionary measure.

TeamUpdraft states it has since secured the access route, logged out all customer accounts, rotated service credentials, and reported the breach to relevant authorities. The company confirmed that it does not store payment card details, as all payments are processed through third-party services like Stripe and PayPal.

What You Should Do

• Update UpdraftPlus: Immediately update your UpdraftPlus plugin to version 1.26.13 Free or 2.26.13 Premium, or any later release. The official changelog confirms that these versions address the key removal process.
• Delete UpdraftCentral Connection Keys: Log directly into each WordPress dashboard. Navigate to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete all old connection keys. Note that Nethemba researchers reported potential cutoff mismatches that might leave some keys active, so manual verification is essential.
• Inspect for Backdoors: Thoroughly inspect plugin files and server logs for any suspicious or unfamiliar activity. Review all user accounts for any unauthorized or unfamiliar administrators. Remember, updating or deleting keys will not remove backdoors that have already been installed.
• Change Passwords: If you are a TeamUpdraft account holder, change your password immediately. If you have reused this password elsewhere, change it on those platforms as well. Reset your two-factor authentication settings. WordPress site administrators should also change their administrative passwords.
• Consider Backup Restoration: If you observe any suspicious activity, TeamUpdraft advises considering restoring your site from a backup taken before October 17, 2026.
• Reconnect Cloud Services Securely: Only reconnect cloud services after you have completed all checks and secured your site.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.