Stolen UpdraftCentral keys used to take over WordPress sites
Attackers used stolen remote-management keys to install malicious plugins and create administrator accounts. Updating UpdraftPlus blocks the stolen keys but does not remove malware already installed. ([teamupdraft.com](
TeamUpdraft disclosed a breach on October 19, 2026, and updated its warning on October 21. Its customer database held connection keys for UpdraftCentral, a service used to manage WordPress sites remotely. Attackers used those connections to take over customer sites. The total number compromised is unknown. (teamupdraft.com)
Check every site connected to UpdraftCentral Cloud. Premium UpdraftPlus users should check even if they do not remember using UpdraftCentral. The vendor says self-hosted UpdraftCentral and official UpdraftPlus downloads were not affected. (teamupdraft.com)
Log in directly to each site's WordPress dashboard. Confirm UpdraftPlus is running version 1.26.13, Premium 2.26.13, or later. These releases revoke the affected connection keys. TeamUpdraft says this blocked the compromised access route. (teamupdraft.com)
An update alone is not a cleanup. Ask your host to scan for malicious plugins and unauthorized accounts, including hidden ones. Imunify360 found backdoors that hide from normal WordPress dashboard lists. (blog.imunify360.com)
Change administrator passwords and your TeamUpdraft password. Reset TeamUpdraft two-factor authentication. If compromise is found, consider restoring a backup from before October 17. Reauthorize remote backup storage and replace its access keys if your site was accessed. (teamupdraft.com)
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.