Stolen UpdraftCentral keys opened WordPress sites. Updating does not delete them.
By Lior AharonovFounder, 7IT Solutions ·
TeamUpdraft found unauthorised access to its website over the weekend of 17 to 18 October 2026 and believes its customer database, including UpdraftCentral connection keys, was reached. Patchstack and Nethemba report attacks from 18 October, 15:32 UTC, adding administrators and at least 99 disguised backdoor plugins. UpdraftPlus plugin files are unaffected.
A backup plugin is trusted with the whole site. These keys let a stranger run code and create an admin, and BleepingComputer cites around 400,000 sites that may hold one.
Update UpdraftPlus to 1.26.13 (2.26.13 Premium) or later, then delete the UpdraftCentral connection keys under Advanced Tools. Review admin users and plugins for strangers; if compromised, restore a clean backup.
The key to your backup tool is a key to the house. Rotating it is your job, even when the vendor was the one breached.
Lior Aharonov · my takeSources
- Stolen UpdraftCentral keys used to backdoor WordPress sites (BleepingComputer) bleepingcomputer.com
Researched with AI tools; every fact is checked against the linked sources.