Attackers who got into TeamUpdraft's website over the weekend of October 17 to 18 are using what they found there to install malicious plugins on WordPress sites. The maker of the UpdraftPlus backup plugin believes its customer database, which held connection keys for its UpdraftCentral, UpdraftVault and UpdraftClone services, was accessed. Researchers at Wordfence, in an advisory by Alex Thomas, say public analysis by Nethemba and reports sent directly to Wordfence show attackers using valid UpdraftCentral keys to send remote commands that upload, activate and delete malicious plugins.
Because those commands were properly signed with trusted keys, the sites treated them as legitimate. That includes sites already patched for the earlier UpdraftPlus flaw CVE-2026-10795. This was not a bug in the plugin. It was the plugin doing exactly what a key holder told it to do.
Only sites wired to the cloud dashboard are exposed
UpdraftCentral is a remote-management service that can handle backups, plugins, themes and users across many WordPress sites from one dashboard. Its client ships inside both UpdraftPlus Free and Premium, but it ignores UpdraftCentral commands unless a connection key exists on the site. Wordfence says the sites most directly at risk are those connected to TeamUpdraft's cloud-hosted UpdraftCentral service. TeamUpdraft says self-hosted UpdraftCentral installations, the plugin's download packages, and backups sent to a customer's own Google Drive, Dropbox or Amazon S3 storage were not affected.
There is a catch for free users. Wordfence notes that UpdraftPlus 1.26.11 offers to add a site to UpdraftCentral when a user connects a TeamUpdraft account, and that option is selected by default, so a site can be connected without its owner remembering it. Reports to Wordfence describe malicious plugins landing on UpdraftPlus Premium 2.26.11.x and on a site running Free 1.26.10 or 1.26.11.
According to TeamUpdraft, the accessed database also held customer names, email and billing addresses, order histories, password hashes and two-factor authentication settings. It says it does not store payment card details, because Stripe and PayPal handle payments.
Malware that can hide the administrator it uses
The publicly analysed attacks used the plugin.upload_plugin command to install a supplied plugin archive, which gave the attacker a way to run malicious PHP wherever the connected WordPress user could install and activate plugins. One malware family described itself as a "Small maintenance toolkit" and used randomised names such as style-bridge-8f5 and Load Stack 35C. Nethemba has since confirmed a second, working variant that can hide an administrator from the WordPress Users screen, or log the attacker in as the first existing administrator without creating any account at all. In that case the plugin file and the web-server access log may be the only evidence left, which is why Wordfence warns that once malicious PHP has run, the WordPress dashboard is not an independent source of truth.
Update to UpdraftPlus 1.26.12 or 2.26.12, then delete every key
TeamUpdraft has released UpdraftPlus 1.26.12 (Free) and 2.26.12 (Premium), which automatically disconnect UpdraftCentral connections created before 21:00 UTC on October 18. Wordfence has pushed an emergency firewall rule, released early to free users as well, that blocks inbound UpdraftCentral requests on affected versions. Neither step removes anything already installed. Wordfence advises owners to log in to each site directly rather than through UpdraftCentral, delete every key under Settings, UpdraftPlus, Advanced Tools, UpdraftCentral, change the teamupdraft.com password from a known-clean device, and inspect plugins, mu-plugins and user records through the hosting panel or database rather than the dashboard. A site whose integrity cannot be established should be restored from a verified backup made before October 17. UpdraftVault users must reconnect with new credentials.
Indicators to hunt for
- Source IPs: 43[.]250[.]53[.]42 and 2a09[:]bac5[:]4e21[:]2e3c[::]49b[:]9
- User-Agent: WordPress/6.4; class-udrpc.php
- UpdraftCentral log entries: Command received: plugin.upload_plugin and plugin.delete_plugin
- SHA-256 (opt4fix 2.9.2): 54ca7b2da87852a5d1fd7bde644027f84557db4d45fbb25cb2d135a3497d8d5c
- SHA-256 (cache-smith 1.3.1): 43dc88fd18501be3dbd6d7f1755e77386d081dd41cef82bc514d39991ae69c49
The lesson is an old one in a new place. A management channel built to be trusted is only as safe as wherever its keys are kept, and here that was the vendor's own website. For other recent WordPress threats, see our coverage of self-healing WordPress malware that hides its command server on Ethereum and attackers hammering an old WooCommerce plugin bug.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.