Your WordPress site might have a new administrator you never created, because unknown attackers breached TeamUpdraft's website and walked away with customer connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, and those keys were then used to push backdoor plugins onto connected sites, which means the compromise started at the vendor but landed on customer servers where nobody was watching for it.

TeamUpdraft is the developer behind UpdraftPlus, a WordPress backup plugin with over four million active installations. The company also runs UpdraftCentral, a remote management service used to administer multiple sites from one dashboard.

That's the product that mattered here. A client component of UpdraftCentral ships inside every copy of UpdraftPlus.

What Happened at TeamUpdraft

The vendor identified unauthorized access to teamupdraft.com over the weekend of October 17 and 18.

TeamUpdraft's statement describes a fast response. The team worked through the night, closed the access route, signed out every account, and replaced the keys and credentials that could have been affected.

What the attackers reached is the customer database.

Those connection keys are the part that turned a database breach into a customer-facing attack.

Why the Connection Keys Matter So Much

A connection key is how a site authorizes UpdraftCentral to send it commands. That's the feature working as designed.

It also means anyone holding a valid key can issue commands to the connected site over the plugin's remote procedure call channel.

Patchstack caught that happening. Its researchers observed an attacker holding valid UpdraftCentral dashboard keys, issuing commands to install backdoor plugins on connected WordPress sites.

Dave Jong of Patchstack described the mechanism plainly. The attacker sends a signed plugin.upload_plugin command over the RPC channel, which listens on ordinary POST requests to the site root. WordPress then installs and activates the supplied plugin through its standard installer.

No exploit in WordPress. No vulnerability in the installer. Just a valid command from a trusted source.

What the Backdoor Plugin Actually Did

Nethemba, a Slovakia-based penetration testing company, first detected the attack in the wild and described the rogue plugin.

It hooks into every request to the site, checks whether the URL contains the parameter ?_9f5696=, and compares it against a 32-character token.

When the token matches, it creates a user called data-ops43 with the display name "Site Tools," assigns the Editor role, and grants manage_options and install_plugins permissions.

That combination is more powerful than the role name suggests. It lets the operator upload arbitrary PHP plugins and open site settings.

Nethemba's assessment goes further. Enabling registration and setting the default role to administrator is enough for the attacker to create a full administrator. And on a standard WordPress site, an Editor has unfiltered_html, which means the account can put JavaScript into posts that runs in the browser of every administrator who views them.

The Layer That Survives Plugin Removal

Here's the part that catches people mid-cleanup.

The account the backdoor creates stays in WordPress even after the plugin is removed. It has a known password, and the attacker can log in through the normal login form unless two-factor authentication is enabled for that account.

Deleting the plugin doesn't delete the user.

The Broken First Attempt

An early version of the plugin had a coding error that caused sites to fail with a 500 error.

Nethemba observed the threat actor deleting that broken backdoor with a plugin.delete_plugin command, then uploading a working version that either creates a full administrator account or logs in as an existing one.

That's an operator iterating in production, and it's a useful reminder that these campaigns get fixed on the fly.

Was Your Site Affected?

Wordfence's analysis set out two conditions, and both need to be true.

• The site had UpdraftPlus Free or UpdraftPlus Premium installed and active while the affected UpdraftCentral connection key was present.
• The site has, or had during the incident, an active connection key for TeamUpdraft's cloud-hosted UpdraftCentral service.

Sites that never connected to the hosted UpdraftCentral service don't meet the second condition. Self-hosted UpdraftCentral installs are also outside the affected scope, per TeamUpdraft.

The campaign itself ran continuously through an 18-hour window on October 18 and 19, 2026.

Indicators of Compromise

If you're checking a site, these are the things to look for.

Plugin names to search for: Site Health Cache, Site Health 364F, Asset Forge 2, Content Helper, Wp Forge, Query Shelf, Style Bridge 8F5, Media Kit 183, Post Dock 776, Nav Hub, Speed Desk, Speed Kit 300, Link Latch, Script Shelf, Feed Case.

Patchstack observed 99 distinct backdoor plugin names in total, and every sample carried the same description line: "Small maintenance toolkit: keeps option storage tidy."

Accounts to search for: system_team850, web.tech988, cmseditor170, cms.tech644, web_mgr684. Watch for an @example.com email and display names like System Team, Web Tech, System Staff, System Ops, or Cms Tech.

And the one from Nethemba's analysis: data-ops43, display name "Site Tools."

IP addresses: 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9.

How to Clean an Affected Site

TeamUpdraft published steps for cloud customers of UpdraftCentral, and the order matters. The keys can send commands to your site, so treat the cleanup as time-sensitive.

• Log in through your own WordPress dashboard. Not through UpdraftCentral.
• Update UpdraftPlus to 1.26.12 (free) or 2.26.12 (Premium) or later. Version 1.26.13 and 2.26.13 are the current releases and include the forced disconnection described below.
• Disconnect from UpdraftCentral. Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete the connection key.
• Check Users for administrator accounts you don't recognize. Remove them. This is the step that handles the persistent account, so don't skip it.
• Check Plugins, including the Must-Use tab if you can see it. Remove anything unfamiliar. Must-use plugins don't show in the normal list, which is exactly why they're worth checking.
• Change the passwords for all administrator accounts.
• If you find anything suspicious, restore from a backup taken before October 17.
• Reconnect the site to UpdraftCentral once it's clean.

What TeamUpdraft Did on Its Side

The vendor released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to automatically disconnect every UpdraftCentral connection made before 10 p.m. BST on October 18, 2026, so the old keys stop working.

It also disconnected every site from UpdraftVault and issued new credentials, replaced every UpdraftClone client key, rotated keys with payment providers and connected services, added monitoring, and reported the incident to the UK Information Commissioner's Office and other authorities.

UpdraftVault users should reconnect their sites to the backup service. UpdraftClone users who created a client key need to copy the new keys from My Account > UpdraftClone > UpdraftClone Key Management and share them with their clients.

Account Holders, Separately

Anyone with a teamupdraft.com account should change that password immediately, and change it anywhere else it was reused. Reset 2FA settings too.

TeamUpdraft also warned about phishing. Expect emails claiming to be from the company, and treat unexpected ones with suspicion.

The Second Incident in Five Months

Patchstack's warning is worth quoting directly: this is the second incident in this channel in five months.

In June 2026, the vendor fixed CVE-2026-10795, a CVSS 8.1 flaw where an obsolete unsigned message format let an attacker forge UpdraftCentral commands with no keys at all. That was fixed in 1.26.5 and 2.26.5.

Exploitation attempts against that flaw continue. Sites below those versions face both problems at once, which is a strong argument for getting current rather than patching to the minimum.

Why This Cluster of WordPress News Matters Together

Three stories landed in the same week, and together they describe a rough stretch for WordPress site owners.

The Rank Math PRO plugin website was hit by a software supply chain attack. Users who downloaded version 3.0.123 between October 15 at 8:02 p.m. UTC and October 16 at 7:12 a.m. UTC received compromised builds that planted hidden backdoors. The incident is tracked as CVE-2026-111862, CVSS 9.8, fixed in version 3.0.124.

Wordfence's description of that malware covers persistent access, communication with rank1cdn[.]com, hidden backdoors recreated on page visits, and exposure of WordPress credentials, database credentials, API keys, and other secrets reachable by the web server.

And PHP announced it intends to ship a security release fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, after information about the flaws leaked ahead of schedule. They've been codenamed PHP2Shell.

WatchTowr CEO Benjamin Harris said the flaws affect PHP versions 5, 6, 7, and 8, and were due for release on October 22 at 11 a.m. ET.

Huntress put the scope in perspective. PHP quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and a lot of software that doesn't advertise that it runs PHP under the hood. When a critical bug lands in PHP itself, the number of places you have to check gets very big, very fast.

Three different layers of the same stack, all compromised or exposed in the same week. The plugin vendor, the plugin distribution path, and the language runtime underneath all of it.

What This Says About Trusting Connection Keys

The uncomfortable lesson here isn't that UpdraftPlus is unsafe. It's that connection keys are bearer credentials, and bearer credentials fail when the place that stores them gets breached.

Nobody did anything wrong by connecting a site to a hosted management service. That's the product's purpose.

But the blast radius is worth understanding before the next outage. A key that can install a plugin can install anything, and the only thing standing between that capability and your site is whoever holds the key.

Two-factor authentication on administrator accounts is the cheapest control in this whole story. It's what stops the persistent backdoor account from being usable after cleanup. It's also the thing most sites leave off.

FAQ

What was the TeamUpdraft breach?

Unknown attackers gained unauthorized access to the teamupdraft.com website over the weekend of October 17 and 18, 2026, and are believed to have accessed a customer database containing names, email addresses, billing details, order history, hashed passwords, 2FA settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone.

Is the UpdraftPlus plugin itself compromised?

No. TeamUpdraft says the plugin, self-hosted UpdraftCentral installs, and backups sent to customers' own remote storage are not impacted. The exposure is the connection keys stored in the vendor's customer database.

How were the connection keys used?

Attackers used valid UpdraftCentral keys to send a signed plugin.upload_plugin command over the plugin's remote procedure call channel, which caused WordPress to install and activate backdoor plugins on connected sites.

Will the problem be solved by removing the backdoor plugin?

No, because the backdoor plugin creates accounts with passwords which still exist even after removing the backdoor plugin. You need to remove these accounts, but two-factor authentication for administrator accounts will stop the attacker.

Which accounts and plugins should I check for?

Look for accounts named data-ops43, system_team850, web.tech988, cmseditor170, cms.tech644, or web_mgr684, and plugins including Site Health Cache, Site Health 364F, Asset Forge 2, Content Helper, Wp Forge, Query Shelf, and others. Patchstack observed 99 distinct backdoor plugin names.

What version of UpdraftPlus should I be running?

At minimum 1.26.12 (free) or 2.26.12 (Premium), though 1.26.13 and 2.26.13 are current and include automatic disconnection of keys created before 10 p.m. BST on October 18, 2026.

Was financial data exposed?

No. TeamUpdraft says payment information is handled by Stripe and PayPal and isn't stored in the affected database.

Source: The Hacker News