Between October 17 and 18, 2026, attackers gained unauthorized access to TeamUpdraft’s website infrastructure. The developer later confirmed that attackers likely accessed its customer database, potentially exposing sensitive account information and private connection keys used by UpdraftCentral.

Security researchers have since identified an active campaign in which attackers use compromised UpdraftCentral keys to remotely install malicious plugins, establish persistent access, and potentially take complete control of affected WordPress websites.

This incident is serious because the attackers do not need to exploit a traditional WordPress plugin vulnerability. Instead, they authenticate using legitimate cryptographic keys obtained through the security breach.

For website owners, this means that even a fully updated WordPress installation could have been vulnerable while an exposed UpdraftCentral connection key remained trusted.

At HostArmada, we want our customers to understand the threat, identify whether their websites may have been affected, and take the necessary precautions to protect their data and online presence.

What Happened? Understanding the UpdraftCentral Security Breach

UpdraftPlus is one of the WordPress ecosystem’s most widely used backup plugins, with more than four million active installations.

Its developer, TeamUpdraft, also operates UpdraftCentral, a service that allows website owners and administrators to manage multiple WordPress websites remotely from a centralized dashboard.

UpdraftCentral provides convenient administrative functionality, including plugin management, updates, and other maintenance operations.

However, these capabilities also make its authentication credentials highly sensitive.

On October 19, 2026, TeamUpdraft publicly confirmed that unauthorized access to its website had been detected during the preceding weekend.

According to its official security disclosure, the potentially accessed customer database contained:

• Customer names, email addresses, billing addresses, and order histories.
• Hashed account passwords and two-factor authentication settings.
• Connection keys associated with UpdraftCentral.
• Credentials associated with UpdraftVault and UpdraftClone.

TeamUpdraft stated that payment details were not stored in the compromised database. The company also reported that its UpdraftPlus plugin distribution files and downloads were not affected, and that self-hosted UpdraftCentral installations were outside the scope of the reported breach.

How Attackers Turned Legitimate Connection Keys Into a Weapon

When a WordPress website connects to UpdraftCentral, a cryptographic trust relationship is established between the website and its remote management dashboard.

The website stores the dashboard’s public key, allowing it to verify administrative commands signed with the corresponding private key.

Under normal circumstances, this mechanism allows authorized administrators to perform remote actions securely.

In this incident, attackers obtained access to valid dashboard keys, enabling them to submit commands that affected websites recognized as authentic.

The attack sequence is straightforward:

1. Compromised UpdraftCentral credentials. Attacker obtains valid private dashboard keys
2. Authenticated remote command. A signed plugin.upload_plugin command reaches the website
3. WordPress accepts the command. The cryptographic signature passes verification
4. Malicious plugin installation. A backdoor is installed and may provide persistent administrative access

Because these commands carry valid signatures, the UpdraftCentral client may execute them without requiring confirmation from the website owner. The privileges available to a remote command depend on the WordPress user associated with the connection.

This is an example of a trusted credential compromise, rather than an ordinary software vulnerability.

Updating WordPress itself or installing a conventional vulnerability patch would not, by itself, invalidate an already-compromised connection key.

How Widespread Is the Attack?

Cybersecurity researchers at Nethemba discovered the initial campaign independently and documented unauthorized plugin installations on their own WordPress installations.

Patchstack subsequently confirmed the activity through its security telemetry and identified a broader campaign. Its initial investigation recorded malicious plugin installations between October 18 at 15:32 UTC and October 19 at 09:23 UTC.

Additional research indicates that the campaign extended beyond these initial observations. Imunify360 reported more than 18,000 related security events across over 2,200 servers during October 18–19. These figures include attack activity and do not mean that every targeted website was successfully compromised.

Importantly, Nethemba’s analysis, updated October 21, reports continued malicious remote-command attempts even after the initial disclosure.

This makes immediate credential revocation and retrospective malware inspection essential.

Who Is Affected? Why Every UpdraftPlus User Should Check

One of the most important discoveries is that exposure is not necessarily limited to website owners who knowingly use UpdraftCentral. 

The UpdraftCentral functionality is included within both the free and Premium versions of UpdraftPlus.

When users connect their websites to a TeamUpdraft account, a preselected option can also establish an UpdraftCentral connection.

Consequently, some websites may have active UpdraftCentral keys even though their owners only intended to use UpdraftPlus for backups.

This makes it essential to distinguish between installing UpdraftPlus and having a remote-management key configured.

A WordPress installation is not vulnerable to this specific stolen-key attack merely because UpdraftPlus is installed. The primary risk arises when the website trusts an affected UpdraftCentral Cloud connection key.

But that doesn’t mean you shouldn’t care. All UpdraftPlus users should verify their configurations, including those who have never intentionally used UpdraftCentral.

What Can the Malicious Backdoor Plugins Do?

The malicious plugins installed during the campaign are designed to establish unauthorized access to WordPress websites.

Researchers have identified multiple backdoor variants with different mechanisms, making this campaign more dangerous than a single identifiable malicious plugin.

1. Create disguised privileged accounts. One observed variant creates a new WordPress user with the Editor role, but assigns additional capabilities typically associated with administrators.

2. Bypass normal login security. Some variants use secret URLs and tokens to bypass login protections, including rate limits and two-factor authentication. Others can access existing administrator accounts without creating new users.

3. Hide from routine inspections. Some malicious plugins hide themselves or unauthorized users from WordPress admin screens. A normal-looking wp-admin does not guarantee a clean website.

4. Maintain access after partial cleanup. Unauthorized access can persist even after you remove a malicious plugin. Some plugins also erase attack evidence during uninstallation, making forensic investigations harder. This is why compromised websites need more than a plugin update or basic malware scan.

How To Protect Your WordPress Website Immediately

If you use UpdraftPlus, follow these steps for every WordPress installation you manage.

1. Update UpdraftPlus to the Latest Secure Release

Access your WordPress dashboard and navigate to Plugins > Installed Plugins.

Find UpdraftPlus and verify the installed version.

As of October 21, 2026, the relevant emergency releases are:

• UpdraftPlus Free: 1.26.13 or later
• UpdraftPlus Premium: 2.26.13 or later

Earlier emergency releases, 1.26.12 and 2.26.12, contained a revocation issue reported by Nethemba. Do not rely on those versions to secure your site.

The newer releases automatically revoke certain pre-incident UpdraftCentral Cloud connections. However, researchers identified a time window in which some keys may survive automatic revocation, so manual verification remains necessary.

2. Check for Existing UpdraftCentral Keys and Remove Them

From your WordPress dashboard, navigate to:

Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral

Find the option labeled Manage existing keys (N)….

If connection keys are present, delete the affected UpdraftCentral Cloud keys. For the safest immediate response when you do not require remote management, remove all existing UpdraftCentral keys.

Removing the website from the central dashboard is not enough because the trusted connection information also exists on the WordPress website itself.

If you have SSH and WP-CLI access, you can check for existing keys using:

wp option get updraft_central_localkeys

If the option contains keys, and you intend to disconnect all UpdraftCentral connections, remove them using:

wp option delete updraft_central_localkeys

Run these commands from the correct WordPress installation directory. On multisite installations, examine each relevant site and its configuration.

Important: Removing UpdraftCentral remote-management keys does not delete your existing UpdraftPlus backups or disable normal scheduled backups to independently configured storage services. It does, however, disconnect the associated remote-management functionality. If you use UpdraftVault, verify that the vendor-required storage reconnection has been completed.

3. Inspect Installed Plugins for Malicious Additions

Navigate to Plugins > Installed Plugins and review the list carefully.

Look for unfamiliar plugins, particularly those installed around October 18–21, 2026.

One strongly associated plugin description is:

Small maintenance toolkit: keeps option storage tidy.

Some observed malicious plugins use the name Site Health Cache, while others have randomly generated names such as Asset Forge 2, Core Smith, Data Engine Cc0, Image Forge, Quick Pack, Seo Helper, and WP Forge.

However, the plugin name alone is not a reliable detection method. Later samples use different descriptions, and some can hide from the WordPress interface.

Inspect the plugin directories on disk, including:

wp-content/plugins/

wp-content/mu-plugins/

If you have shell access, search for the known description:

grep -RIlF “Small maintenance toolkit: keeps option storage tidy.” wp-content/plugins/

An empty result does not guarantee that the site is clean. The command detects only samples containing that exact text.

4. Check WordPress User Accounts and Permissions

Navigate to Users > All Users and review every account, not just administrators.

In some observed cases, malicious accounts had:

• An Editor role with unexpected administrative capabilities.
• Email addresses using @example.org.
• The display name Site Tools.
• Randomized usernames containing two words and two digits.

Two publicly documented examples are data-ops43 and media-staff96.

These indicators are useful, but they are not exhaustive. Some malicious variants create regular administrators, while others reuse existing accounts.

If you have database access, inspect user capabilities for unexpected privilege combinations. For a conventional WordPress installation with the default table prefix, this query can help identify Editors with administrative permissions:

SELECT u.ID, u.user_login, u.user_email, m.meta_value

FROM wp_users AS u

JOIN wp_usermeta AS m ON m.user_id = u.ID

WHERE m.meta_key = ‘wp_capabilities’

  AND m.meta_value LIKE ‘%editor%’

  AND (

    m.meta_value LIKE ‘%manage_options%’

    OR m.meta_value LIKE ‘%install_plugins%’

  );

If your database uses a custom table prefix, update both the table names and meta_key accordingly. This is a targeted detection query, not a complete security audit.

Don’t delete a legitimate account just because it matches a pattern. First verify its ownership, creation history, and assigned permissions.

5. Reset Credentials and Review Active Sessions

If you have a TeamUpdraft account, change its password and reset its two-factor authentication configuration. If your WordPress installation shows indicators of unauthorized access, also:

• Reset WordPress administrator passwords.
• Invalidate existing login sessions.
• Review privileged accounts and remove confirmed malicious users.
• Rotate potentially exposed application credentials and API keys.
• Reauthorize or rotate remote backup-storage credentials if the site was accessed through the compromised management channel.
• Enable or reconfigure two-factor authentication for legitimate administrative accounts.

Two-factor authentication remains an important protective measure, although it cannot retroactively prevent access obtained through a stolen trusted connection key or a backdoor that bypasses the login form.

6. Investigate Suspicious Activity and Restore From a Clean Backup if Necessary

Review website access logs, UpdraftCentral command logs, WordPress user activity, recently modified files, and suspicious scheduled tasks.

If compromise is suspected, preserve relevant logs and files before cleanup.

If malware or unauthorized administrative access is confirmed, the safest recovery approach may involve restoring from a verified clean backup dated before the attack, rebuilding affected components from trusted sources, and rotating credentials.

TeamUpdraft recommends considering backups taken before October 17, 2026.

Be aware that restoring a backup without first revoking the exposed keys could reintroduce the original weakness. After restoration, repeat the malware and account inspections before returning the website to normal operation.

Technical Indicators of Compromise (IOCs)

For developers, website administrators, and incident response teams, the following indicators can help identify potentially affected WordPress installations.

These indicators were reported by Patchstack and other independent investigators. They are not comprehensive and should not be treated as the only evidence of compromise.

The attacker has used multiple plugin variants and can change infrastructure, filenames, account details, and backdoor behavior. Blocking the two known IP addresses alone is therefore not sufficient.

Advanced Log Inspection

Investigate unexpected plugin.upload_plugin commands in UpdraftCentral logs, particularly when they have no matching legitimate administrative action.

Also look for suspicious requests containing a short underscore-prefixed query parameter and a 32-character token.

One possible log-search pattern is:

grep -E ‘[?&]_[A-Za-z0-9]{4,10}=[A-Za-z0-9_]{32}([&”[:space:]]|$)’ access.log

This pattern is based on the initial backdoor activation mechanism described by Patchstack. It is not guaranteed to identify every variant.

Investigators should also examine unusual WordPress authentication events, plugin-directory modifications, and server-side PHP errors. Some early malicious plugins caused HTTP 500 errors, but later working variants may not produce obvious website failures.

For deeper investigation, Nethemba also published a security-checking script and continued updating its analysis as new variants emerged. Review it before executing any third-party script on a production website.

Is This Connected to a Vulnerability in UpdraftPlus Itself?

Not directly. The October 2026 incident involves compromised credentials belonging to a trusted remote-management service. The attacker used these credentials to issue otherwise legitimate-looking commands.

It should not be confused with the earlier vulnerability CVE-2026-10795, which affected the UpdraftCentral communication channel and was patched in June 2026.

Although the incidents involve the same remote-management functionality, their exploitation mechanisms are different.

The June vulnerability allowed certain commands to be forged without possessing the appropriate keys. The October incident instead involves the misuse of valid cryptographic credentials believed to have been exposed during the TeamUpdraft breach.

This distinction matters because applying a software patch does not undo the actions an attacker may already have performed.

What Is Being Done To Contain the Attack?

TeamUpdraft has reported taking several measures, including securing the affected infrastructure, invalidating sessions, rotating relevant credentials, and releasing emergency UpdraftPlus updates to revoke affected UpdraftCentral connections.

On October 20, the vendor stated that the unauthorized access to its own infrastructure had been resolved. Its October 21 advisory further emphasized the importance of inspecting WordPress websites for unexpected plugins, accounts, and suspicious activity.

Separately, cybersecurity providers have introduced mitigations targeting the attack campaign.

Patchstack reported blocking UpdraftCentral remote commands for customers protected by its relevant mitigation rules, while Imunify360 published detection signatures and web application firewall protections against observed attacker behavior.

These protections can reduce exposure, but their availability depends on the security products and configurations deployed on a particular website or hosting environment.

Most importantly, blocking new attacks does not automatically eliminate an existing compromise.

What Hostarmada Customers Should Know

At HostArmada, we recognize the importance of maintaining a secure and reliable hosting environment, especially when incidents involving widely used WordPress technologies emerge.

This particular attack originates from the compromise of a third-party remote-management trust relationship. It does not, by itself, indicate a breach of HostArmada’s hosting infrastructure.

Still, customers running WordPress installations with UpdraftPlus should inspect their websites and take the recommended precautions, regardless of their hosting plan.

We strongly encourage all affected customers to update UpdraftPlus, verify their UpdraftCentral connections, inspect installed plugins and WordPress user accounts, and review their websites for indications of unauthorized activity.

Website owners who discover suspicious files, unfamiliar privileged accounts, or unexpected administrative actions should treat the situation as a potential security incident and prioritize investigation before continuing routine maintenance.

If you are a HostArmada customer and need assistance with hosting-level access, available backups, or the location of your WordPress files, you can contact our support team through your usual support channels.

Final Thoughts: Take Preventive Action Now

The UpdraftCentral incident demonstrates how the compromise of a trusted third-party service can place large numbers of otherwise well-maintained websites at risk.

Traditional security practices such as keeping WordPress updated, using strong passwords, and enabling two-factor authentication remain essential. However, this campaign illustrates why website owners must also monitor remote-management integrations, privileged credentials, and unexpected administrative activity.

For HostArmada customers, our message is simple: If you use UpdraftPlus, check your website today.

Verify that you are running the latest secure version, remove unnecessary UpdraftCentral connections, inspect your plugins and user accounts, and investigate anything suspicious.

A few proactive checks now can help prevent unauthorized access from developing into a much more serious security incident.

Last reviewed: October 21, 2026.

FAQs