Exposed UpdraftCentral Keys Power WordPress Backdoor Campaign

TeamUpdraft’s website was breached over the October 17-18 weekend, exposing customer database records that included names, email addresses, billing addresses, order history, hashed passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Financial data was not exposed, as payment processing is handled externally by Stripe and PayPal. The UpdraftPlus plugin itself—which has over four million active installations—remained uncompromised.

Attackers exploited the exposed connection keys to remotely deploy backdoor plugins on WordPress sites. The malicious plugin monitors incoming requests for a URL parameter ”?_9f5696=” and, when matched with a 32-character token, creates an account named “data-ops43” (displayed as “Site Tools”) with Editor role privileges including manage_options and install_plugins permissions. The campaign unfolded over an 18-hour window on October 18-19. Security firm Patchstack catalogued 99 distinct backdoor variants, while Slovakia-based penetration testing company Nethemba first discovered the attack. Documented indicators include two IP addresses: 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9.

TeamUpdraft released patched versions 1.26.13 (free) and 2.26.13 (Premium) to disconnect old connections and directed users to audit their sites for unauthorized accounts and plugins. This represents the second breach via this vector in five months; the first was CVE-2026-10795 (CVSS 8.1) patched in June 2026 but still exploited against unpatched installations. The breach coincided with a separate supply chain attack on Rank Math PRO plugin, which distributed compromised version 3.0.123 between October 15-16 before being patched in version 3.0.124.