TeamUpdraft, the creators of the UpdraftPlus WordPress backup plugin, recently revealed a security breach on their website. This breach allowed attackers to obtain remote management keys, which were then used to install malicious plugins on associated WordPress sites. The attackers exploited these trusted management features to execute harmful code.
Details of the Security Breach
The security incident occurred between October 17 and 18, 2026, when unauthorized access to teamupdraft.com was detected. This breach potentially compromised the customer database, which stores names, email addresses, billing information, order histories, password hashes, two-factor authentication settings, and connection keys associated with UpdraftCentral, UpdraftVault, and UpdraftClone.
Although the breach did not affect the plugin files themselves, the attackers managed to exploit connection keys to send harmful commands, leveraging the site’s trust in these keys to execute unauthorized plugin installations.
Exploit Through Malicious Plugin Installation
UpdraftCentral provides administrators with a centralized dashboard to manage multiple WordPress sites, allowing commands signed with a private key to be executed with the connected user’s permissions. Attackers used this feature to send a command known as plugin.upload_plugin with valid keys. If the linked user had sufficient permissions, WordPress would accept the request and activate the malicious PHP code.
In some instances, the attack was unsuccessful due to insufficient user permissions. The exploit did not bypass the previously addressed CVE-2026-10795 vulnerability, as the sites were already running the latest version of UpdraftPlus. Instead, it capitalized on the stolen keys to bypass standard security checks.
Measures for Protection and Recovery
Both free and premium users of UpdraftPlus could be vulnerable if their sites were connected via compromised cloud connection keys. TeamUpdraft has assured that its plugin files and download packages remain unaltered, and self-hosted UpdraftCentral setups along with backups on personal cloud storage were not impacted by the breach.
The company has taken steps to mitigate further risks by closing the access route, logging out customer accounts, rotating service credentials, and notifying authorities. Administrators are advised to update to UpdraftPlus 1.26.13 Free or 2.26.13 Premium to ensure security patches are applied.
Users should manually inspect their WordPress dashboards, remove outdated connection keys, and check for unusual plugin files or server logs. Changing passwords and resetting two-factor authentication are also recommended. If any suspicious activities are detected, restoring from a backup taken before October 17 is advised.
While an Endpoint Detection and Response (EDR) alert might highlight an attack, comprehensive measures are essential to fully understand and mitigate such security incidents.
