Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
Reported exploitedUpdraftPlusUpdraftCentralOur summary
An attacker possessing valid UpdraftCentral dashboard keys is pushing backdoor plugins to WordPress sites connected through UpdraftPlus's remote management feature, with activity confirmed over an 18-hour window on 18-19 October 2026. Because the rogue commands are properly signed with genuine private keys, the plugin itself cannot distinguish them from legitimate instructions, so no UpdraftPlus update — including the latest 1.26.11 and 2.26.11.26 — currently stops the attack; the only mitigation is deleting all UpdraftCentral keys from affected sites. This follows an earlier flaw, CVE-2026-10795, patched by TeamUpdraft in June 2026 in the same UpdraftCentral channel, meaning older installs below 1.26.5/2.26.5 face compounded risk. Patchstack and researcher Nethemba are tracking the ongoing campaign and have published indicators of compromise while a vendor fix is still pending.
Below is the opening; the full story is at Patchstack.
From Patchstack
UpdraftPlus / UpdraftCentral
Remote Management Key Compromise – Backdoor Deployment
An attacker holding valid UpdraftCentral dashboard keys is installing backdoor plugins on connected WordPress sites. The campaign ran continuously through an 18-hour window on 18-19 October. Patchstack blocks UpdraftCentral remote commands and has deployed mitigation rules covering it.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.