UpdraftCentral Cloud Key Compromise – Signed Commands Install Malicious WordPress Plugins

Incident status: Active exploitation was observed after unauthorized access to TeamUpdraft systems exposed UpdraftCentral Cloud connection keys. Attackers used trusted, signed remote commands to install and activate malicious plugins on connected WordPress sites.

This is a connection-key compromise, not a newly assigned CVE and not the same issue as CVE-2026-10795. A site can be exposed even when it runs a recently patched UpdraftPlus version if it retained a leaked UpdraftCentral Cloud key.

Affected Scope and Prerequisites

• UpdraftPlus Free or Premium sites connected to UpdraftCentral Cloud with a connection key.
• Self-hosted UpdraftCentral installations are not affected by the TeamUpdraft Cloud key exposure.
• Not every UpdraftPlus installation is affected. UpdraftPlus has more than four million active installations, but exposure requires a Cloud connection key.
• Sites accessed through UpdraftCentral should also reauthorize remote storage integrations and rotate applicable storage access keys.

Exploit Path

According to Wordfence and TeamUpdraft, attackers obtained valid UpdraftCentral connection keys during unauthorized access to teamupdraft.com on October 17-18, 2026. Those keys allowed remote commands that WordPress treated as trusted. Observed commands included plugin.upload_plugin and plugin.delete_plugin, enabling malicious plugin installation, activation, and cleanup without exploiting a conventional unauthenticated plugin endpoint.

Because the commands were correctly signed with compromised keys, updating alone cannot prove that a site was never accessed. Administrators must revoke keys and investigate for persistence.

Immediate Remediation

1. Update UpdraftPlus Free to 1.26.13 or later, or Premium to 2.26.13 or later.
2. In WordPress, open Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete every local UpdraftCentral key, even if the site is no longer shown in the Cloud dashboard.
3. Disconnect and reconnect only after the site has been checked for compromise.
4. Reauthorize remote storage services used through UpdraftCentral and rotate related API tokens or access keys.
5. Review administrator accounts, active and inactive plugins, must-use plugins, scheduled tasks, and recently modified PHP files.
6. Reset WordPress administrator passwords and invalidate active sessions if compromise is suspected.

Version warning: Initial vendor guidance named versions 1.26.12 and 2.26.12. The current WordPress.org changelog says 1.26.13 “properly” applies the revocation introduced in 1.26.12. Updated independent analysis also found that the earlier release did not reliably delete the key. Use 1.26.13/2.26.13 or later and still remove all keys manually.

Indicators of Compromise

• Source IP addresses reported by Wordfence: 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9.
• User-Agent: WordPress/6.4; class-udrpc.php.
• UpdraftPlus log entries referencing probe.central.updraftplus.com, Command received: plugin.upload_plugin, or Command received: plugin.delete_plugin.
• Plugin description: Small maintenance toolkit: keeps option storage tidy.
• Observed plugin names include Load Stack 35C, Text Gantry Eb0, style-bridge-8f5, speed-press-23b, hero-bridge-6c9, site-health-6a20, db-works-7dba, cache-frame, and site-engine.
• Unexpected administrators with display name Site Tools, usernames such as data-ops43, media-staff96, site_editor784, site.crew51, or web_desk9, and addresses at example.org or example.com.
• Suspicious option names ending in _sync_token, _uid, or _installed.
• Code that combines wp_set_auth_cookie() with hash_equals(), or hooks pre_user_query and pre_count_users to hide accounts.

Some observed malware hides users or plugins from wp-admin. Do not rely on the dashboard alone.

Safe Verification Commands

Run these read-only WP-CLI checks from the WordPress document root:

wp plugin get updraftplus --fields=name,status,version,update,update_version
wp plugin list --fields=name,status,version,update,update_version
wp user list --fields=ID,user_login,user_email,display_name,user_registered
wp cron event list
wp core verify-checksums
wp plugin verify-checksums --all

Checksum verification may report expected exceptions for premium or private plugins. Investigate each exception against a trusted vendor package.

Review recent files at the operating-system level:

find wp-content/plugins wp-content/mu-plugins -type f -mtime -7 -print
find wp-content/uploads -type f -name '*.php' -print

The UpdraftCentral key is stored in the updraft_central_localkeys option. Do not print or paste its value into tickets, chat, or logs. For incident containment, remove keys through the UpdraftPlus interface so the action is explicit and auditable.

Sources

• Wordfence: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins
• TeamUpdraft: Security Incident October 2026
• Nethemba: UpdraftCentral Backdoor Analysis
• WordPress.org: UpdraftPlus plugin page and changelog