Security1 hOctober 21, 2026, 08:01

TeamUpdraft breach: stolen UpdraftCentral keys used to backdoor WordPress sites

A threat actor breached TeamUpdraft's website and customer database, exposing UpdraftCentral, UpdraftVault and UpdraftClone connection keys. Since October 18 attackers have used them to install admin-level backdoor plugins; roughly 400,000 sites may be exposed. UpdraftPlus 1.26.13 / 2.26.13 fixes the issue.

BleepingComputer

Open source

TeamUpdraft breach: stolen UpdraftCentral keys used to backdoor WordPress sites

Breach of teamupdraft.com occurred over the weekend of October 17–18
About 400,000 sites at risk, roughly 10% of UpdraftPlus users
At least 99 malicious plugins disguised as maintenance tools logged
Sites on WordPress 7.1.3 and UpdraftPlus 2.26.11 were hit despite the CVE-2026-10795 patch

#WordPress#UpdraftPlus#UpdraftCentral#TeamUpdraft

Malicious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

Security

WordPress backdoor SC rebuilds itself after cleanup

Security

Rank Math PRO 3.0.123 malware forces full recovery for activated sites

Security

TeamUpdraft breach: stolen UpdraftCentral keys used to backdoor WordPress sites

Malicious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

WordPress backdoor SC rebuilds itself after cleanup

Rank Math PRO 3.0.123 malware forces full recovery for activated sites

Critical Forminator flaw enables RCE on 600,000 WordPress sites