A recent UpdraftPlus security breach affected a popular WordPress backup plugin active on more than 3 million sites, letting bad actors create rogue admin profiles and drop harmful plugins. Search Engine Journal reports that the incident stemmed from stolen remote connection credentials following a company database intrusion over the weekend of October 17 through October 18, 2026.
Key takeaways
- TeamUpdraft suffered a customer database compromise that exposed remote management connection keys.
- Attackers used those stolen keys to issue fake administrative commands without needing passwords.
- Security patches numbered 1.26.13 for free users and 2.26.13 for premium users arrived on October 19, 2026.
- The updates automatically sever previous remote links to block ongoing unauthorized access paths.
What caused the UpdraftPlus security breach?
TeamUpdraft confirmed that unauthorized parties accessed customer records over the mid-October weekend. Those exposed files contained connection secrets for UpdraftCentral, a tool that lets managers control multiple sites from one dashboard. Because the keys were genuine, the target websites processed incoming commands as valid instructions from the remote manager. According to Search Engine Journal, security firm Patchstack noted that the event did not stem from a software bug in the plugin itself.
Instead, the stolen keys allowed outsiders to impersonate the remote service. Normal security checks on the target sites passed because the instructions carried valid cryptographic signatures. Using this method, the intruders commanded connected WordPress sites to download harmful software containing hidden backdoors. These rogue files created Editor accounts and silently elevated them to administrator status while bypassing standard login hurdles like two-factor authentication.
How did the WordPress backup plugin updates fix it?
TeamUpdraft pushed out hotfixes to address the risk, releasing version 1.26.13 for free software and version 2.26.13 for paid tiers on October 19, 2026. These releases revoke older cloud dashboard keys and force an automatic disconnection for linked domains. WordPress.org pushed these updates out automatically to users. Patchstack identified nearly 99 distinct titles used for the rogue files, including fake maintenance tools like Site Health Cache designed to look harmless.
What it means for site owners
Website administrators running the affected software must verify their user lists for unknown accounts and check their active extensions for unfamiliar names. Search Engine Journal points out that sites could have active remote links even if the owner never used the management dashboard, because the feature was often enabled by default. Checking installed extensions and applying the latest software patches remains important for securing vulnerable domains against leftover entry points.
Frequently asked questions
Attackers accessed a TeamUpdraft customer database over the weekend of October 17-18, 2026, stealing connection keys for the UpdraftCentral management tool.
TeamUpdraft released version 1.26.13 for the free plugin and version 2.26.13 for the premium version on October 19, 2026.
According to Patchstack analysis, it was not a software bug in the plugin; rather, stolen genuine keys allowed attackers to impersonate the remote dashboard.
The rogue plugins contained a backdoor that created WordPress user accounts with the Editor role and then granted them administrative permissions.
The incident affects websites that had active UpdraftCentral cloud connections, which could happen automatically even if the owner did not intend to use the feature.
Based on reporting by Search Engine Journal. Read the original article
