Unknown threat actors breached TeamUpdraft's website and used stolen connection keys to install backdoor plugins on WordPress sites, according to a statement from the company and analysis published by WordPress security firm Patchstack. TeamUpdraft develops UpdraftPlus, a backup plugin with over four million active installations, and offers UpdraftCentral, a service for managing multiple WordPress sites remotely. The company disclosed the intrusion occurred over the weekend of October 17-18, 2026, and said attackers potentially gained unauthorized access to customer database records and connection credentials.
The compromised database held names, email addresses, billing addresses, order histories, and hashed account passwords, according to TeamUpdraft. Attackers also accessed connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone services. Patchstack observed an attacker with valid UpdraftCentral dashboard keys issuing commands to install backdoor plugins on connected WordPress sites through an 18-hour window on October 18 and 19. The attack exploited the plugin's remote procedure call channel, which listens for POST requests at the site root, to upload and activate rogue plugins through WordPress's standard installer. Slovakia-based security firm Nethemba, which first detected the campaign, said the backdoor plugin checks incoming URLs for a specific parameter and creates a user account called "data-ops43" with elevated permissions, including the ability to upload arbitrary PHP plugins and access site settings. Patchstack identified 99 distinct backdoor plugin names during the incident, including Site Health Cache, Asset Forge 2, Content Helper, and Speed Desk.
TeamUpdraft responded by closing the access route, signing out every account, and replacing affected keys and credentials. The company released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) to automatically disconnect every UpdraftCentral connection made before 10 p.m. BST on October 18, 2026, preventing old keys from working. TeamUpdraft also disconnected every site from UpdraftVault and issued new credentials, replaced every UpdraftClone client key, rotated its keys with payment providers, and reported the incident to the U.K. Information Commissioner's Office. The vendor emphasized that the UpdraftPlus plugin itself, self-hosted versions of UpdraftCentral, and backups sent to customers' own remote storage weren't impacted, though it advised users whose sites were accessed through UpdraftCentral to re-authorize remote storage and change access keys as a precaution.
Patchstack warned this marks "the second incident in this channel in five months," noting that in June 2026 the vendor fixed CVE-2026-10795, a vulnerability where an obsolete unsigned message format allowed attackers to forge UpdraftCentral commands without any keys. The development comes days after the Rank Math PRO WordPress plugin suffered a software supply chain attack that planted hidden backdoors in version 3.0.123, assigned CVE-2026-111862 with a CVSS score of 9.8. TeamUpdraft is urging cloud customers of UpdraftCentral to update UpdraftPlus to the latest version, disconnect from UpdraftCentral, check for unrecognized administrator accounts and plugins, change all administrator passwords, and consider restoring from backups taken before October 17 if they find anything suspicious. The backdoor contains a second layer: the account it creates remains in WordPress even after the plugin is removed, and attackers can log in through the normal login form unless two-factor authentication is enabled. The supply chain risk facing WordPress plugin ecosystems isn't limited to code vulnerabilities—compromise at the vendor level can turn trusted management tools into attack vectors, and the persistence mechanisms built into these backdoors suggest attackers understand how to maintain access even after initial detection and cleanup efforts.