Stolen UpdraftCentral keys used to backdoor WordPress sites

TeamUpdraft, the company behind popular WordPress backup tools, suffered a breach of its website over the weekend of October 17-18, giving an attacker access to its customer database, including password hashes, two-factor authentication settings, and connection keys used by UpdraftCentral, UpdraftVault, and UpdraftClone to remotely manage sites. Researchers from Patchstack and Nethemba report that attackers started abusing these stolen UpdraftCentral keys on October 18 to push dozens of fake plugins—disguised as tools like "Site Health Cache"—that create rogue administrator accounts, even on fully patched installations running WordPress 7.1.3 and UpdraftPlus 2.26.11 (already fixed against CVE-2026-10795). Since roughly 10% of UpdraftPlus users have an UpdraftCentral or Migrator key configured, as many as 400,000 websites could be at risk, as attackers are signing malicious commands with valid private dashboard keys rather than exploiting any plugin flaw. TeamUpdraft urges customers to update to UpdraftPlus 1.26.13 or UpdraftPlus Premium 2.26.13, remove existing UpdraftCentral connection keys, check for indicators of compromise, and reset account credentials and two-factor authentication if a breach is confirmed.