UpdraftCentral Key Theft Turned Every Connected WordPress Site Into a Backdoor Target
Over the weekend of October 17–18, 2026, unknown threat actors breached the TeamUpdraft website and exfiltrated customer records including connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Armed with valid dashboard keys, attackers issued signed plugin.upload_plugin commands through UpdraftCentral's remote procedure call channel across an 18-hour window on October 18–19, silently installing backdoor plugins on connected WordPress sites. The rogue plugins created privileged ghost accounts with Editor and administrator-level capabilities, established persistent access, and left secondary backdoor credentials that survived plugin removal. Over 99 distinct backdoor plugin variants were observed, affecting any site actively connected to TeamUpdraft's cloud-hosted UpdraftCentral service. This incident underscores an accelerating pattern of supply-chain attacks targeting WordPress ecosystem management tools. It follows CVE-2026-10795 patched only five months prior and coincides with a simultaneous supply-chain compromise of the Rank Math PRO plugin and the disclosure of critical PHP2Shell vulnerabilities, signaling coordinated or opportunistic exploitation of the broader WordPress infrastructure layer at scale.
Kill Chain
