A safety breach affecting UpdraftPlus, a WordPress backup plugin installed on complete 3 myriad websites, enabled attackers to instal malicious plugins and create unauthorized director accounts. The assault exploited compromised UpdraftCentral association keys, allowing attackers to obtain authority of connected WordPress websites without needing a username or password.
Updraft Website Compromised
TeamUpdraft confirmed that its website was compromised complete the weekend of October 17-18, 2026. The business believes attackers accessed its client database, which contained client data and association keys for services including UpdraftCentral. Those compromised keys enabled attackers to acquire authority of connected WordPress websites.
Updraft Security Response
A TeamUpdraft blog article explained that the unauthorized admission path at the bosom of the breach was closed, that the possibly compromised credentials were replaced, and that safety updates were released that revoke older UpdraftCentral connections.
The updates, UpdraftPlus 1.26.13 for the liberated type and 2.26.13 for the premium version, were released on October 19, 2026.
The plugin changelog describes the updates as revoking UpdraftCentral Cloud keys, alongside type 1.26.13 correcting how the revocation was applied in the preceding release. The updates automatically disconnect affected websites from UpdraftCentral, blocking additional admission through that route.
The business additionally reported that WordPress.org had pushed the updated plugin to users automatically.
UpdraftPlus WordPress Backup Plugin
The UpdraftPlus plugin is used by WordPress websites to create backups, reconstruct websites, and migrate sites to distinct hosting providers or domain names. It supports automated backups and enables website owners to shop backup copies of their websites on services specified as Google Drive, Dropbox, and Amazon S3.
The plugin additionally includes UpdraftCentral, a distant administration characteristic that enables website owners to oversee multiple WordPress installations from a sole dashboard. That characteristic is at the center of the safety incident.
The Compromise Of UpdraftCentral
UpdraftCentral uses safety keys to authenticate instructions sent from the distant dashboard to connected websites. Those keys authorize the assistance to execute administrative actions without requiring person to log in to all website separately.
Compromised Security Keys Enable Website Takeover
The compromised UpdraftCentral keys enabled attackers to dispatch commands to connected WordPress websites that appeared to be lawful instructions from the distant administration service.
Standard safety checks couldn’t differentiate between lawful instructions and those authenticated alongside taken keys. As a result, WordPress websites accepted the attackers’ commands as authorized.
In safety business Patchstack’s first analysis, published before TeamUpdraft released the safety updates, the matter was explained as not an genuine vulnerability:
“This is not a exposure in UpdraftPlus, and as of 19 October no plugin update stops it. The commands are correctly encrypted and signed alongside genuine dashboard personal keys. Every inspect in the plugin passes, since from the site’s item of perspective the education is legitimate.”
What that method is that the attackers weren’t exploiting a programming error in the UpdraftPlus plugin itself. The safety checks were operating as designed, but the taken keys allowed attackers to impersonate the distant administration service.
Malicious Plugins Installed
Using the compromised UpdraftCentral safety keys, attackers sent commands to connected WordPress websites instructing them to instal and activate malicious plugins. Because the commands were authenticated alongside genuine safety keys, the websites treated them as lawful instructions and installed the plugins through WordPress’s normal plugin facility process.
The malicious plugins contained a backdoor that could create a WordPress person document alongside the Editor function and afterward aid that document additional administrative permissions.
Although an Editor document normally lacks approval to instal plugins or oversee crucial WordPress settings, the malicious code separately granted those capabilities. That made the unauthorized accounts difficult to acknowledge since they could appear to be average Editors during possessing permissions normally reserved for administrators.
The backdoor additionally bypassed the normal WordPress login process, bypassing safety measures specified as two-factor authentication and login attempt restrictions.
Patchstack’s inspection established that the malicious plugins contained a coding error that caused affected websites to come back server errors before the backdoor could activate. However, this error didn’t eliminate the danger posed by the malicious plugins.
Patchstack identified 99 distinct names used for the malicious plugins, including one named Site Health Cache. The names mostly resembled lawful website care and achievement tools, making them small apparent to website owners reviewing their installed plugins.
WordPress Sites May Be Connected Without Owners Realizing It
An crucial item concerning this safety event is that a website owner power have an energetic UpdraftCentral association equal if they never intended to use the distant administration service.
Patchstack reported that connecting a website to a TeamUpdraft document could automatically create an UpdraftCentral association since the choice to allow distant administration was selected by default. Consequently, websites using UpdraftPlus strictly for backups could have energetic association keys without location owners realizing it.
The event affects websites alongside energetic UpdraftCentral Cloud connections, not all website alongside the UpdraftPlus plugin installed. Patchstack additionally confirmed that the safety matter affected the two liberated and premium versions of UpdraftPlus. TeamUpdraft stated that self-hosted UpdraftCentral installations were not affected.
UpdraftPlus Users Urged To Check Their Websites
TeamUpdraft is urging website owners, including those who have never knowingly used UpdraftCentral, to inspect their websites for evidence of unauthorized activity.
The business recommends reviewing installed plugins for unfamiliar additions and checking WordPress person accounts for unauthorized administrators.
Website owners should additionally verify that they are operating UpdraftPlus 1.26.13 or 2.26.13, or a newer version, and eliminate any remaining compromised UpdraftCentral association keys.
The association keys can be managed through the WordPress dashboard under Settings, UpdraftPlus, Advanced Tools, and UpdraftCentral.
TeamUpdraft additionally recommends changing director passwords and considering restoration from a backup created before October 17 if evidence of colony is discovered.
Users alongside TeamUpdraft accounts are additionally advised to alter their document passwords.
The business says there is currently no evidence that attackers keep admission to its systems, but its inquiry remains ongoing.
Although the safety updates obstacle additional admission through the compromised connections, they don’t eliminate malicious plugins or unauthorized accounts that may already be on affected websites. That’s why checking for evidence of colony remains crucial equal following updating.
Featured Image by Shutterstock/Kues
