PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites

TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information.

Public analysis by Nethemba and reports submitted directly to Wordfence have documented attackers using valid UpdraftCentral connection keys to send remote commands to connected WordPress sites. Those commands were used to upload, activate, and delete malicious plugins. Because the requests were properly signed with trusted keys, an UpdraftPlus installation that contained the earlier CVE-2026-10795 security fix could still accept them as legitimate UpdraftCentral instructions.

This does not mean that every website running UpdraftPlus was exposed. The UpdraftCentral remote-management client is included in both UpdraftPlus Free and UpdraftPlus Premium, but it does not accept UpdraftCentral commands unless a connection key exists on the site. The users most directly at risk are those whose sites were connected to TeamUpdraft’s cloud-hosted UpdraftCentral service.

The rule prevents both malicious and legitimate UpdraftCentral commands from reaching the plugin while older connection keys are being retired. The rule does not interfere with ordinary UpdraftPlus backups or backups sent to third-party storage providers.

TeamUpdraft has released UpdraftPlus 1.26.12 (Free) and UpdraftPlus 2.26.12 (Premium), which automatically disconnect UpdraftCentral connections created before the incident cutoff. We recommend updating every UpdraftPlus site to one of these versions or later.

Firewall protection cannot undo a compromise that occurred before the rule was deployed. UpdraftCentral users should still inspect every connected site and follow TeamUpdraft’s official incident guidance. TeamUpdraft says that page may be updated as its investigation continues, so it should remain the authoritative source for product-specific instructions.

Incident Summary

UpdraftCentral is a remote-management service that can manage backups, plugins, themes, users, and other WordPress functionality from a central dashboard. When a site is connected, the site and dashboard establish cryptographic keys. UpdraftPlus then accepts commands signed by the trusted dashboard key and runs them with the permissions of the WordPress user who created the connection.

Publicly analyzed attacks used the plugin.upload_plugin command to install a supplied plugin archive. Where the connected WordPress user had permission to install and activate plugins, that command provided the attacker with a path to execute malicious PHP on the site.

The defining issue in this incident is the compromise and misuse of legitimate UpdraftCentral connection keys. A request signed with an exposed key could pass the plugin’s normal authentication checks and be treated by the connected site as a trusted remote-management instruction.

Reports submitted to Wordfence describe successful malicious plugin installations on UpdraftPlus Premium 2.26.11.x and on another site known to have been running UpdraftPlus Free 1.26.10 or 1.26.11 at the time of the activity. These reports reinforce that sites with an exposed cloud UpdraftCentral connection could be affected even when they were running recent plugin versions.

TeamUpdraft says the UpdraftPlus plugin and its downloadable packages were not affected. It also says backups sent to a user’s own Google Drive, Dropbox, Amazon S3, or other third-party remote storage were not affected, and that self-hosted UpdraftCentral installations were not affected by the compromise of teamupdraft.com. However, if a site was accessed through UpdraftCentral, TeamUpdraft recommends re-authorizing its remote storage and changing any storage access keys as a precaution.

According to TeamUpdraft, the customer database contained names, email addresses, billing addresses, order histories, password hashes, and two-factor authentication settings. The company says passwords were not stored in plain text and that it does not store payment-card details because payments are handled by Stripe and PayPal. TeamUpdraft nevertheless advises every teamupdraft.com account holder to change their password, change it anywhere it was reused, and reset their TeamUpdraft two-factor authentication settings.

Who May Be Affected?

A website may be affected if all of the following are true:

• The site had UpdraftPlus Free or UpdraftPlus Premium installed and active while the affected UpdraftCentral connection key remained present.
• The site has, or had during the incident, an active connection key for TeamUpdraft’s cloud-hosted UpdraftCentral service.

Unless an effective firewall rule blocks the channel or UpdraftPlus 1.26.12 (Free) or 2.26.12 (Premium) has removed it, a site with an old key that still exists locally can continue accepting commands correctly signed with that key. Deleting the key stops future UpdraftCentral commands but does not erase activity that may already have occurred.

Installing the free UpdraftPlus plugin does not, by itself, automatically connect a site to UpdraftCentral. However, UpdraftPlus 1.26.11 presents an option to add the website to UpdraftCentral when a user connects a TeamUpdraft account, and that option is selected by default. A site can therefore have an UpdraftCentral connection even if its owner did not separately visit the UpdraftCentral dashboard or does not remember deliberately enabling remote management.

Both free and Premium users should check if they have ever connected the plugin to a TeamUpdraft account. TeamUpdraft’s official guidance says free UpdraftPlus users who do not have a teamupdraft.com account do not need to take action for this incident.

How to Check Whether a Site Has an UpdraftCentral Key

Log in directly to the site’s own WordPress dashboard. Do not perform this check through UpdraftCentral.

Navigate to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. If the page shows Manage existing keys (N) with one or more keys, the site is or was configured to accept UpdraftCentral commands and should be treated as potentially exposed.

At the database level, these connections are stored in the WordPress option named updraft_central_localkeys. After WordPress deserializes the option value, an array containing one or more key entries indicates that at least one local UpdraftCentral connection exists. An empty array does not. Do not post or send populated option contents publicly because they contain sensitive key material.

The absence of a current key does not prove that no malicious command was previously received. If a key was recently deleted, continue with the log, plugin, user, and file checks below.

What Wordfence Is Doing

Wordfence Premium, Wordfence Care, and Wordfence Response customers received a real-time firewall rule that acts as a temporary kill switch for the affected UpdraftCentral command channel. Given the severity of this incident, we also made the rule available early to Wordfence Free users, just a few hours later. The rule blocks inbound UpdraftCentral UDRPC requests on UpdraftPlus Free versions up to and including 1.26.11 and on UpdraftPlus Premium versions that predate 2.26.12.

Wordfence users should manually refresh their firewall rules now, as described at the top of this post. If your site uses UpdraftCentral, you should still delete its connection keys and complete the checks below, because the firewall rule cannot undo activity that occurred before it was deployed.

The rule is narrowly scoped to the affected cloud UpdraftCentral command channel. It does not interfere with ordinary backups, restores, or backups sent to third-party remote storage providers. It does temporarily block legitimate cloud UpdraftCentral management commands on affected versions, so a protected site may appear unavailable in UpdraftCentral until it is running UpdraftPlus 1.26.12 (Free) or 2.26.12 (Premium) or later.

TeamUpdraft has released emergency versions of UpdraftPlus, UpdraftPlus 1.26.12 (Free) and 2.26.12 (Premium), that automatically disconnect UpdraftCentral connections created before 21:00 UTC (22:00 BST) on October 18, 2026. TeamUpdraft says connections made afterward using its manual reconnection steps will not be disconnected. Update to UpdraftPlus 1.26.12 or 2.26.12 or later now, logging in to each site’s own WordPress dashboard rather than updating through UpdraftCentral, and do not treat the update as a substitute for inspecting and securing a connected site.

The firewall rule prevents future inbound commands on covered versions. It cannot remove a malicious plugin, account, scheduled task, or other persistence that may already exist.

What UpdraftCentral Users Should Do Now

TeamUpdraft’s published guidance provides the minimum containment steps. The additional checks below are important because once malicious PHP has executed, the WordPress dashboard is not an independent source of truth. Malware can filter the Users and Plugins screens, conceal a Must-Use plugin, or grant powerful capabilities to an account whose visible role appears harmless. Complete these steps separately on every connected website:

1. Log in directly to the site’s WordPress dashboard rather than through UpdraftCentral.
2. Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete every existing connection key.
3. From a known-clean device, change the teamupdraft.com password by typing the address directly into the browser. Change the password anywhere else it was reused, and reset TeamUpdraft two-factor authentication in My Account if it was enabled. Be cautious of unexpected messages claiming to be from TeamUpdraft; the company says it will never ask for your password or connection keys.
4. Before removing suspicious files or accounts, preserve the UpdraftCentral log, web-server access logs, PHP error logs, and copies of suspicious files when practical. Record recently modified files and the current plugin and user lists. This evidence may be needed to determine what the attacker changed.
5. Update UpdraftPlus to 1.26.12 (Free) or 2.26.12 (Premium) or later. The update disconnects old UpdraftCentral connections, but it does not remove anything an attacker may already have installed, so complete the remaining checks as well.
6. Run a Wordfence scan. Use the High Sensitivity scan type when compromise is suspected, and review every result involving malware, unknown or modified files, skipped paths, suspicious options, or administrator accounts created outside the normal WordPress interface. High Sensitivity scanning can produce false positives, so investigate results before deleting or repairing files. A clean scan is useful evidence, but it does not prove by itself that the site is clean.
7. Inspect the filesystem independently through your hosting control panel, SFTP, or SSH. Do not rely only on the WordPress Plugins screen. Review wp-content/plugins, wp-content/mu-plugins, wp-content/upgrade, themes, uploads containing executable files, WordPress root files, and PHP files in wp-admin and wp-includes. Check WordPress drop-ins such as advanced-cache.php, db.php, object-cache.php, and sunrise.php when present. Compare WordPress, plugin, and theme files with known-clean copies from trusted sources, and investigate files created or modified around the incident.
8. Inspect accounts independently of the WordPress Users screen. Review the site’s user and user-metadata records through a trusted database or hosting tool, including effective capabilities, active sessions, and application passwords. On multisite installations, also review network users and super administrators. One publicly analyzed malware family could grant administrator-like capabilities to an account labeled as an Editor. A second, working variant can hide a full administrator from normal dashboard queries or authenticate the attacker as an existing administrator without creating a new account.
9. Review UpdraftCentral, web-server, and security logs for the commands and network indicators listed below. Determine whether an upload or deletion command was received, whether a plugin was written or activated, and what requests followed it.
10. If you find suspicious activity or cannot independently establish the site’s integrity, do not treat removal of a visible plugin or user as sufficient. Restore the website and database from a verified clean backup created before October 17, 2026, reinstall WordPress core, plugins, and themes from trusted sources as appropriate, and complete a full incident investigation.
11. After the site has been inspected and any required cleanup or restoration is complete, change every WordPress administrator password and end existing sessions. If the site was compromised, also rotate hosting, file-transfer, database, and application credentials that the compromised site could access.
12. Reconnect the site with a new UpdraftCentral key only after the checks and any required cleanup are complete. Sites covered by Wordfence’s temporary firewall rule may not accept UpdraftCentral commands until UpdraftPlus 1.26.12 (Free) or 2.26.12 (Premium) or later is installed. TeamUpdraft says newly created connections will not be removed by that update.

If you find any indicator of compromise, or cannot independently complete the filesystem and database checks above, we recommend contacting Wordfence for professional investigation and cleanup. Wordfence Care and Wordfence Response customers can request hands-on incident response and malware removal from our security team.

Deleting a site only from the cloud UpdraftCentral dashboard is not a substitute for deleting the key on the WordPress site itself. The local key determines whether the site will accept a signed command.

It is necessary to both change passwords and remove UpdraftCentral connection keys for connected sites.

Guidance for UpdraftVault and UpdraftClone Users

TeamUpdraft says it disconnected every site from UpdraftVault and issued new credentials. UpdraftVault backups will not resume until the service is reconnected. In the site’s WordPress dashboard, go to Settings > UpdraftPlus > Settings, select UpdraftVault under remote storage, use Already got space? > Connect, enter the TeamUpdraft account email and new password, save the settings, and run a manual backup to confirm that storage is working.

TeamUpdraft also says every UpdraftClone client key has been replaced. Users who never created a client key do not need to act. Users who shared keys with clients should retrieve the replacements from My Account > UpdraftClone > UpdraftClone Key Management and distribute the new keys. Clones using an old key will fail.

UpdraftCentral, UpdraftVault, and UpdraftClone use separate credentials, and TeamUpdraft has issued product-specific response steps for each service. Wordfence’s emergency firewall rule addresses the affected cloud UpdraftCentral command channel used in the publicly observed attacks.

Indicators of Compromise

The following indicators come from public analysis by Nethemba, corroborating reports in the WordPress.org UpdraftPlus support forum (report one, report two), and incident reports submitted directly to Wordfence. The attacker varied plugin names and other details, so these indicators should be used together. Their absence does not prove that a connected website is clean.

UpdraftCentral Logs

In Settings > UpdraftPlus > Advanced Tools > UpdraftCentral, review recent UpdraftCentral log events. Investigate entries containing:

• probe.central.updraftplus.com
• Command received: plugin.upload_plugin
• Command received: plugin.delete_plugin

A received upload command does not necessarily mean that activation succeeded, but it does mean the site received an attempt through the UpdraftCentral channel. UpdraftPlus retains only a limited number of recent Central log events, so older activity may no longer appear.

Network Indicators

Public reports and incident reports submitted to Wordfence associated the campaign with the following source addresses:

• 43.250.53.42
• 2a09:bac5:4e21:2e3c::49b:9

Observed malicious requests used the exact User-Agent WordPress/6.4; class-udrpc.php. Legitimate TeamUpdraft traffic publicly analyzed by Nethemba included a UDRPC library version and the teamupdraft.com URL in the User-Agent. Attackers can change IP addresses and headers, so blocking or searching for these values alone is not sufficient.

The working malware variant was triggered through a request to the site root containing a query-string parameter whose name consisted of 12 hexadecimal characters and whose value was a 32-character token. In some cases, a successful request may be followed by a redirect and authenticated administrator activity. Treat this as a log-hunting pattern rather than proof by itself, and correlate it with unexpected plugin installation, file creation, or administrator activity.

Malicious Plugins

One high-confidence indicator for the first publicly analyzed malware family is the description:

Small maintenance toolkit: keeps option storage tidy.

The analyzed plugins used randomized-looking names. Public examples include Load Stack 35C, Text Gantry Eb0, and style-bridge-8f5. Additional names reported directly to Wordfence include speed-press-23b, hero-bridge-6c9, site-health-6a20, db-works-7dba, cache-frame, and site-engine. Defenders should not rely on names alone. Investigate any plugin that appeared without a corresponding authorized administrator action, particularly around October 18-19, 2026.

Some analyzed samples contained a coding error that caused HTTP 500 responses and WordPress “critical error” messages naming an unfamiliar plugin. A site continuing to work normally does not rule out compromise; not every installation or activation produced the same visible failure.

Nethemba has since confirmed a second, working variant whose names and descriptions change between samples. This variant can hide an administrator from the WordPress Users screen or authenticate the attacker as the first existing administrator without creating a new account, in which case the plugin file and web-server access log may be the only remaining evidence. Stable code-level indicators in analyzed samples include a call to wp_set_auth_cookie() after hash_equals() validates a query-string value, along with pre_user_query and pre_count_users hooks used to hide a created account. This is why description-only malware signatures and dashboard-only inspections are insufficient.

Selected Malware File Hashes

The following newly confirmed SHA-256 hashes identify exact files observed in this campaign. They will not detect renamed or newly generated samples, and this is not an exhaustive list:

• opt4fix 2.9.2: 54ca7b2da87852a5d1fd7bde644027f84557db4d45fbb25cb2d135a3497d8d5c
• js-fix-757a 2.8.3: 2cdf3f2a3f10f0e12f00f2267907d44796107ab4aececdac520bba13e012b47a
• lazy-tool-3055 1.3.8: 1821a58e2a851acd1a608a77ce2f77817a0b7b6ef344b9889c8f8728e62969ec
• cache-smith 1.3.1: 43dc88fd18501be3dbd6d7f1755e77386d081dd41cef82bc514d39991ae69c49
• style-bridge-8f5 2.6.6: 0290c2baa363eac72ef2b6891bef1c9c8b4774d5b95d14f4871bde6094fdacde
• style-bridge-8f5/uninstall.php: 99a7fb44d1502938a40b3f663f4e5771b5cf741bcbaec58d7dda0b5066b5a0a5

Users and Database Options

Publicly analyzed samples attempted to create a user that appeared to have the Editor role while separately granting capabilities such as manage_options and install_plugins. Reported supporting indicators include:

• The display name Site Tools
• Usernames such as data-ops43, media-staff96, site_editor784, site.crew51, or web_desk9
• Email addresses using @example.org
• A WordPress option whose name ends in _sync_token
• An unfamiliar plugin-associated option whose name ends in _uid or _installed

The malware could vary these values, and working-variant accounts have also used addresses ending in @example.com. Review the effective capabilities of every unfamiliar user, not just the role label shown in the WordPress Users screen. The working variant may instead hide a full administrator or reuse the first existing administrator without creating a new account, so the absence of an unfamiliar database user does not rule out successful exploitation.

What to Do If You Find Evidence of Compromise

Delete the site’s UpdraftCentral connection keys first so the exposed channel cannot be used to send another command. Preserve relevant logs and suspicious files for investigation when practical, then remove unauthorized plugins and accounts.

Because a malicious plugin can execute arbitrary PHP with the web server’s permissions, deleting the visible plugin alone is not enough to establish that the site is clean. Restore the website and database from a known-clean backup created before October 17, 2026 when possible. Otherwise, have an experienced security professional inspect the WordPress files, database, administrator and application-password records, Must-Use plugins, scheduled events, server-level scheduled tasks, and other writable locations.

After cleanup, change WordPress administrator passwords, end existing sessions, and rotate WordPress security salts, hosting and file-transfer credentials, database credentials, remote backup storage authorizations and access keys, and any application or API secrets the compromised website could access. Re-enable or reset two-factor authentication where applicable. If the TeamUpdraft password and two-factor authentication reset was not completed earlier from a known-clean device, complete it now.

Wordfence Care and Wordfence Response customers can contact our incident response team for hands-on investigation and malware removal. Wordfence Care includes incident response during business hours, while Wordfence Response provides 24/7/365 availability with a one-hour response time. Learn more about Wordfence Care and Wordfence Response.

Timeline

• October 17-18, 2026: TeamUpdraft identified unauthorized access to teamupdraft.com.
• October 19, 2026: Nethemba published its analysis after detecting signed UpdraftCentral commands and malicious plugin installations on connected sites.
• October 19, 2026: Wordfence received multiple customer reports describing malicious plugins installed through the UpdraftCentral UDRPC channel on connected sites.
• October 19, 2026: TeamUpdraft published its official incident advisory, said it had closed the access route, deployed a fix for the underlying weakness, signed out accounts, rotated affected credentials and its keys with payment providers and other connected services, disconnected Vault sites, replaced Clone client keys, added monitoring, reported the incident to the UK Information Commissioner’s Office (ICO), and started preparing an emergency UpdraftPlus release.
• October 19, 2026: TeamUpdraft released UpdraftPlus 1.26.12 (Free) and 2.26.12 (Premium), which automatically disconnect UpdraftCentral connections created before 22:00 BST on October 18, 2026.
• October 19, 2026: Wordfence deployed emergency firewall protection to Wordfence Premium, Wordfence Care, and Wordfence Response customers to block inbound UpdraftCentral UDRPC commands on affected UpdraftPlus versions.
• October 19, 2026: Given the severity of the attack, Wordfence made the same firewall rule available early to Wordfence Free users, a few hours after premium customers received it.

Conclusion

TeamUpdraft disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information.

This incident affects the trust relationship between TeamUpdraft’s cloud-hosted UpdraftCentral service and connected WordPress sites. It does not affect every installation of UpdraftPlus, and it is not evidence that UpdraftPlus plugin downloads or third-party backup storage were compromised. The primary site-level risk applies where a cloud UpdraftCentral connection key existed.

If your site has or recently had such a key, log in to the site directly, remove every old key, reset the TeamUpdraft password and two-factor authentication from a known-clean device, and investigate the indicators above. If anything suspicious is present, restore from a known-clean backup created before October 17 or complete a professional cleanup and full incident response. After the site is known clean, change WordPress administrator passwords, end existing sessions, and rotate any other credentials the compromised site could access. Follow TeamUpdraft’s current guidance when reconnecting with a new key, and update UpdraftPlus to 1.26.12 (Free) or 2.26.12 (Premium) or later. Sites under Wordfence’s temporary firewall protection may not accept the new UpdraftCentral connection until that update is installed.

Wordfence Premium, Wordfence Care, and Wordfence Response customers are protected against new inbound UpdraftCentral UDRPC requests on affected versions by our emergency firewall rule, and sites running Wordfence Free can now get the same protection. Wordfence users can manually refresh their firewall rules to get it immediately. That protection is an important containment measure, but it should be combined with the vendor’s key-rotation steps and a review for activity that may have occurred before the rule was deployed.

The post PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites appeared first on Wordfence.