TeamUpdraft breach: stolen UpdraftCentral connection keys are used to push backdoor plugins to connected WordPress sites, with no flaw in UpdraftPlus and no CVE; deleting the keys is the fix

TeamUpdraft says unauthorised access to teamupdraft.com on 17 and 18 October and that it believes its customer database was accessed, which holds connection keys for UpdraftCentral, UpdraftVault and UpdraftClone; it says UpdraftPlus plugin files and downloads were not affected (TeamUpdraft, 2026-10-19). Patchstack reports that an attacker holding valid UpdraftCentral dashboard keys has been installing backdoor plugins on connected WordPress sites since 2026-10-18 at 15:32 UTC, and that this is not a vulnerability in UpdraftPlus: the UpdraftCentral client ships inside every copy of the plugin and executes any command signed with the dashboard's private key once the site holds a key (Patchstack, 2026-10-19; BleepingComputer, 2026-10-20).

The attacker sends a signed plugin.upload_plugin command as an ordinary POST to the site root and WordPress installs and activates the plugin; each delivered plugin wakes on a secret URL parameter carrying a 32-character token, creates an account with a hardcoded password, gives it the Editor role and then the manage_options and install_plugins capabilities, and logs the visitor in with a cookie, which bypasses the login form, two-factor authentication and login-protection plugins (Patchstack, 2026-10-19). The account stays after the plugin is removed, and early samples crash the site with an HTTP 500 and must not be repaired, because fixing the error switches the backdoor on (Patchstack, 2026-10-19). Nethemba adds a variant that logs the attacker in as an existing administrator without a database trace (Nethemba, 2026-10-19).

A site holds a key if it was connected to UpdraftCentral or if a teamupdraft.com account was logged in from the plugin, where the option to add the site to UpdraftCentral is ticked by default, and keys do not expire (Patchstack, 2026-10-19); on UpdraftPlus 1.26.4 or 2.26.4 and earlier an attacker needs no key at all, through CVE-2026-10795, fixed in 1.26.5 and 2.26.5 (Patchstack, 2026-10-19). BleepingComputer reports an estimate of up to about 400,000 sites (BleepingComputer, 2026-10-20; Nethemba, 2026-10-19). TeamUpdraft says UpdraftPlus 1.26.13 and 2.26.13 revoked the connection keys; Nethemba says 1.26.12 and 2.26.12 deleted none and that even 1.26.13 does not delete keys created on 18 October between 12:07 and 21:00 UTC, which have to be deleted by hand (TeamUpdraft, 2026-10-19; Nethemba, 2026-10-19).