WordPress Backup Plugin Developer Hacked to Inject Malicious Code on Installed Sites

TeamUpdraft, the developer behind the UpdraftPlus WordPress backup plugin, has disclosed a website breach that exposed remote management keys. Attackers used those keys to install malicious plugins on connected WordPress sites, turning a trusted management feature into a route for running harmful code.

The company identified unauthorized access to teamupdraft.com during October 17–18, 2026. Attackers likely accessed its customer database, including names, email addresses, billing details, order histories, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone.

Attackers Installed Malicious WordPress Plugins

UpdraftCentral lets administrators manage WordPress sites from one dashboard. Connected sites trust commands signed with the dashboard’s private key and run them with the permissions of the WordPress user who created the connection.

Nethemba researchers documented attackers sending the plugin.upload_plugin command with valid keys. Where the linked user could install and activate plugins, WordPress accepted the request and loaded malicious PHP code. On one investigated site, the attempt failed because the linked user lacked those permissions.

This was not a bypass of the earlier CVE-2026-10795 security fix. Nethemba’s affected sites already ran UpdraftPlus 2.26.11. The stolen keys allowed requests to pass normal checks without exploiting that earlier flaw.

Researchers found backdoors disguised as maintenance tools. Working variants could log attackers into existing administrator accounts or create new ones. Some hid from the plugin list, while broken versions caused PHP errors and website outages. A normal administrator list therefore does not rule out compromise.

Both free and Premium UpdraftPlus users may be exposed if their sites held affected cloud UpdraftCentral connection keys. Installing UpdraftPlus alone does not create that connection. However, connecting a TeamUpdraft account can present a checked option to add the site to UpdraftCentral, making forgotten connections worth reviewing.

TeamUpdraft says the plugin itself and its download packages were not altered. This differs from the GravityForms supply chain attack, where malicious code reached users through compromised downloads. Earlier UpdraftPlus backup exposure also involved a separate plugin flaw, not stolen cloud management keys.

The vendor says self-hosted UpdraftCentral and backups stored in customers’ own Google Drive, Dropbox, or Amazon S3 were not affected by its website breach. Sites accessed through UpdraftCentral should still renew storage access as a precaution.

TeamUpdraft says it has closed the access route, signed out customer accounts, rotated service credentials, and reported the breach to authorities. It does not store payment card details, with payments handled through Stripe and PayPal.

Administrators should update to UpdraftPlus 1.26.13 Free or 2.26.13 Premium, or later. The official changelog confirms these releases correct the key removal introduced in 1.26.12. Nethemba also reports a cutoff mismatch that can leave some exposed keys present, so manual checks remain important.

Log into each WordPress dashboard directly and open Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. Delete old connection keys, inspect plugin files and server logs, and review unfamiliar users. Updating or deleting keys cannot remove backdoors already installed.

TeamUpdraft account holders should change their passwords, replace reused passwords elsewhere, and reset two-factor authentication. Administrators should also change site administrator passwords. If suspicious activity appears, TeamUpdraft advises considering a restore from a backup taken before October 17. Reconnect cloud services only after completing the checks and securing the site.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post WordPress Backup Plugin Developer Hacked to Inject Malicious Code on Installed Sites appeared first on Cyber Security News.