# Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites Following TeamUpdraft Breach

> TeamUpdraft's website and customer database were breached on 17-18 October 2026, exposing UpdraftCentral, UpdraftVault and UpdraftClone connection keys along with password hashes and 2FA settings. Attackers used the stolen keys to send correctly signed UpdraftCentral plugin.upload_plugin commands and deployed at least 99 backdoor plugins that create hidden administrator access on an estimated 400,000 exposed WordPress sites.

- **Published:** 2026-10-21T01:12:02Z
- **Last reviewed:** 2026-10-24T13:46:38.926Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3995
- **ID:** TL-2026-3995
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-10795

## Description

On the weekend of 17-18 October 2026 an unauthorized party accessed TeamUpdraft's website and customer database. TeamUpdraft states the exposed data included names, email addresses, billing addresses, order history, hashed account passwords, two-factor authentication settings, and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card details (processed by Stripe/PayPal), the UpdraftPlus plugin code itself and remote backups were reported as not compromised. Nethemba reports the keys include valid RSA private keys able to sign UpdraftCentral commands; keys do not expire (keys from November 2025 still worked in October 2026, and some from February 2022 were confirmed active).

Using the stolen keys, the attacker sent signed commands over UpdraftCentral's RPC channel (ordinary POST requests to the site root, parsed by class-udrpc.php) with the command plugin.upload_plugin. Patchstack notes the commands were correctly encrypted and signed with genuine dashboard private keys, so every plugin version, including 1.26.11 and 2.26.11, accepts them. The first installation was observed on 2026-10-18 at 15:32 UTC and the last at 2026-10-19 at 09:23, an roughly 18-hour campaign window in which 99 distinct plugin names were deployed. The attacker traffic carried a User-Agent of 'WordPress/6.4; class-udrpc.php' lacking the library version and URL that legitimate dashboard traffic carries, and came from 43.250.53.42 (plus an IPv6 address); Patchstack reports the attacker rotated infrastructure within a single day.

Nethemba documented three backdoor variants. Variant 1 (plugin names like load-stack-35c, text-gantry-eb0) creates an Editor-role account with manage_options and install_plugins capabilities, uses a 32-character token in a URL parameter of the form _ plus 6 hex characters, and contained a fatal PHP bug that crashed some sites (HTTP 500). Variant 2 (single-file plugins such as opt4fix, cache-smith, boost-kit) uses a 12-hex-character trigger parameter; without extra arguments it logs in the first existing administrator, and with m=setup it creates a full administrator and stores its ID in a <slug>_uid option. Variant 3 is a minimal ~673-byte single file (site-health-364f, site-health-cache) that logs in an existing admin or creates a hidden account and hides itself via all_plugins and pre_user_query filters. All variants log the attacker in with wp_set_auth_cookie (14-day remember-me cookie), bypassing 2FA, login limits and security plugins; created accounts survive removal of the plugin. The Patchstack-identified plugin description 'Small maintenance toolkit: keeps option storage tidy.' is the most reliable plugin indicator.

Vendor response: UpdraftPlus 1.26.12/2.26.12 auto-disconnected legacy sessions (but had a bug preventing key removal) and 1.26.13/2.26.13, released 19 October after 10pm BST, revoke old connection keys. Estimated exposure is about 400,000 sites (about 10% of UpdraftPlus's 4+ million installations). CVE-2026-10795 (CVSS 8.1, UpdraftPlus <=1.26.4 UpdraftCentral RPC signature-verification bypass, fixed in 1.26.5 in June 2026) is a separate earlier flaw in the same RPC channel; the sources describe the October campaign as abuse of genuine stolen keys, not exploitation of that CVE. No named threat actor has been attributed.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1552.004 Private Keys
- T1505 Server Software Component
- T1136.001 Local Account
- T1098 Account Manipulation
- T1098 Account Manipulation
- T1036.005 Match Legitimate Resource Name or Location
- T1564 Hide Artifacts
- T1606 Forge Web Credentials
- T1071.001 Web Protocols
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1070 Indicator Removal
- T1550 Use Alternate Authentication Material

## Sources

- [Stolen UpdraftCentral keys used to backdoor WordPress sites (BleepingComputer)](https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/)
- [TeamUpdraft: Security incident October 2026](https://teamupdraft.com/blog/security-incident-october-2026/)
- [Patchstack: UpdraftCentral key compromise - WordPress backdoors](https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/)
- [Nethemba: Critical security problem in UpdraftCentral - an attacker holding the service's keys planted a backdoor](https://nethemba.com/updraftcentral-backdoor-analysis/)
- [Cyber Kendra: Stolen UpdraftCentral Keys Backdoor WordPress Sites](https://www.cyberkendra.com/2026/10/updraftcentral-stolen-keys-wordpress-backdoor.html)
- [SecurityOnline: UpdraftPlus Data Breach Leads to UpdraftCentral Backdoor Attacks on WordPress Sites](https://securityonline.info/updraftplus-data-breach/)
- [WP Umbrella: UpdraftPlus Backdoor Attack - What Happened and How to Protect Your Sites](https://wp-umbrella.com/blog/updraftplus-backdoor-attack-what-happened-and-how-to-protect-your-sites/)
- [NVD: CVE-2026-10795 (UpdraftPlus UpdraftCentral RPC authentication bypass)](https://nvd.nist.gov/vuln/detail/CVE-2026-10795)
- [Wordfence: UpdraftPlus <= 1.26.4 Unauthenticated Authentication Bypass via UpdraftCentral UDRPC](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/updraftplus/updraftplus-wp-backup-migration-plugin-1264-unauthenticated-authentication-bypass-via-updraftcentral-udrpc)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3995