WordPress security firm Wordfence says attackers used compromised UpdraftCentral connection keys to push malicious plugins onto connected sites after TeamUpdraft disclosed unauthorized access to its website over the October 17-18, 2026 weekend. The incident affects sites that were linked to TeamUpdraft’s cloud-hosted remote-management service, not every installation of UpdraftPlus, and it has prompted both an emergency firewall rule and new plugin versions that automatically retire older keys.
What happened with UpdraftCentral connection keys
According to TeamUpdraft, its teamupdraft.com website was breached and the company believes its customer database was accessed. That database reportedly contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information. Wordfence says public analysis by Nethemba, together with reports submitted to its own team, showed attackers using valid UpdraftCentral keys to send remote commands to connected WordPress sites.
Those signed requests were treated as trusted instructions by the plugin, allowing attackers to upload, activate, and delete malicious plugins. Wordfence says this remained possible even on sites that had already received the earlier CVE-2026-10795 fix, because the requests were properly signed with stolen keys.
Why only some WordPress sites were exposed
The risk does not apply to every WordPress site running UpdraftPlus. The UpdraftCentral remote-management client is included in both UpdraftPlus Free and Premium, but it only accepts remote commands when a connection key exists on the site. In practice, the users most directly at risk are those whose sites were connected to TeamUpdraft’s cloud-hosted UpdraftCentral service.
TeamUpdraft also said that the UpdraftPlus plugin itself and its downloadable packages were not affected, and that backups sent to third-party storage providers such as Google Drive, Dropbox, or Amazon S3 were not impacted by the compromise. Self-hosted UpdraftCentral installations were also not affected by the teamupdraft.com breach, according to the company.
Wordfence releases emergency firewall protection
Because of the severity of the incident, Wordfence says it released an emergency firewall rule early to Wordfence Free customers, a few hours after making it available to Wordfence Premium, Care, and Response users. The rule blocks inbound UpdraftCentral UDRPC requests on affected UpdraftPlus versions.
Wordfence says the rule does not interfere with ordinary UpdraftPlus backups or backups sent to third-party storage providers. It does, however, block both malicious and legitimate UpdraftCentral commands on vulnerable versions until the affected sites are updated.
How Wordfence users can refresh protection
Wordfence recommends manually refreshing firewall rules in the WordPress dashboard by going to Wordfence > Firewall > All Firewall Options, expanding Advanced Firewall Options, and using the Rules section to click Manually Refresh Rules. That downloads the latest rules, including the one aimed at this campaign.
The company stresses that firewall protection is only a containment step. It cannot undo any changes made before the rule was deployed, including plugin installations, account changes, or file modifications.
New UpdraftPlus versions disconnect old keys
TeamUpdraft has released UpdraftPlus 1.26.12 for Free users and 2.26.12 for Premium users. These versions automatically disconnect UpdraftCentral connections created before 21:00 UTC, or 22:00 BST, on October 18, 2026. TeamUpdraft says connections made after that cutoff using its manual reconnection process will not be disconnected.
Wordfence recommends updating every UpdraftPlus site to 1.26.12 or 2.26.12 or later, and doing so from each site’s own WordPress dashboard rather than through UpdraftCentral. The company also warns that updating alone is not enough if the site may already have been compromised.
How the attack worked
UpdraftCentral is designed to manage backups, plugins, themes, users, and other WordPress features from a central dashboard. When a site is connected, the dashboard and site establish cryptographic keys, and the site accepts commands signed by the trusted dashboard key. In this case, attackers appear to have abused those legitimate keys rather than bypassing the authentication model outright.
Publicly analyzed attacks used the plugin.upload_plugin command to install a supplied plugin archive. If the connected WordPress user had permission to install and activate plugins, that gave attackers a route to execute malicious PHP on the site.
What TeamUpdraft says was exposed
TeamUpdraft says the customer database contained names, email addresses, billing addresses, order histories, password hashes, and two-factor authentication settings. The company says passwords were not stored in plain text and that it does not store payment-card details because payments are handled by Stripe and PayPal.
As a precaution, TeamUpdraft advises account holders to change their password, change any other accounts where the same password was reused, and reset their TeamUpdraft two-factor authentication settings. It also says its incident guidance may be updated as the investigation continues.
What connected site owners should check
Wordfence says the minimum response is to delete any UpdraftCentral connection keys on the WordPress site itself, not just in the cloud dashboard. It also recommends reviewing logs, files, users, and database entries for evidence of unauthorized activity, because malicious plugins can hide themselves, alter roles, or create persistence in ways the normal dashboard may not reveal.
Practical response steps
- Log in directly to the site’s own WordPress dashboard.
- Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete every existing connection key.
- Change the TeamUpdraft password from a known-clean device and reset TeamUpdraft two-factor authentication if it was enabled.
- Preserve UpdraftCentral logs, web-server access logs, PHP error logs, and suspicious files when possible.
- Update UpdraftPlus to 1.26.12 or 2.26.12 or later.
- Run a Wordfence scan and inspect the filesystem independently through SFTP, SSH, or the hosting control panel.
- Review users, capabilities, application passwords, and multisite super admins, not just what appears in the WordPress dashboard.
Indicators of compromise noted by researchers
Wordfence says public reports and incident submissions point to several indicators, including requests that reference probe.central.updraftplus.com and commands such as plugin.upload_plugin and plugin.delete_plugin. The campaign has also been associated with source addresses including 43.250.53.42 and the IPv6 address 2a09:bac5:4e21:2e3c::49b:9.
Observed malicious requests used the User-Agent string WordPress/6.4; class-udrpc.php. Wordfence warns that attackers can change IPs, headers, filenames, and plugin descriptions, so no single indicator should be treated as definitive proof of compromise or cleanliness.
UpdraftVault and UpdraftClone were also affected
TeamUpdraft says it disconnected every site from UpdraftVault and issued new credentials. Users who rely on that service will need to reconnect it in the WordPress dashboard before backups resume.
The company also says every UpdraftClone client key has been replaced. Users who share keys with clients should retrieve the replacements from My Account > UpdraftClone > UpdraftClone Key Management and distribute the new keys.
Timeline of the incident
TeamUpdraft says it identified unauthorized access to teamupdraft.com over the weekend of October 17-18, 2026. On October 19, 2026, Nethemba published its analysis, Wordfence received multiple customer reports, TeamUpdraft published its advisory and emergency release, and Wordfence deployed the emergency firewall rule. Wordfence later made the same rule available to Free users as well.
The episode is a reminder that remote-management services can become a high-value target: when connection credentials are stolen, an attacker can use a legitimate trust relationship against the site itself. For site owners with an UpdraftCentral connection, the safest approach is to revoke old keys, update immediately, and inspect the site as if an attacker may already have acted.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: October 20, 2026 at 10:33 pm
1 views
