Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites

TeamUpdraft, maker of the UpdraftPlus backup plugin used on over four million WordPress sites, disclosed that attackers breached teamupdraft.com over the weekend of October 17-18 and likely accessed its customer database, including connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Security researchers at Patchstack and Nethemba say threat actors used stolen UpdraftCentral keys to issue remote commands that installed malicious backdoor plugins on connected sites during an 18-hour attack window on October 18-19; the implant creates a hidden administrator account ("data-ops43") that persists even after the rogue plugin is removed. TeamUpdraft has released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to sever old UpdraftCentral connections and urges affected site owners to update, disconnect and reconnect, rotate credentials, and check for unknown admin accounts or plugins. The incident follows a related flaw, CVE-2026-10795, patched in June, and comes amid separate WordPress-adjacent security scares involving the Rank Math PRO plugin supply-chain compromise and the leaked PHP2Shell vulnerabilities in PHP.