TeamUpdraft Breach Leads to Backdoor Attempts on Connected WordPress Sites
Summary
TeamUpdraft reported unauthorized access to its website and suspected exposure of customer connection keys. Attackers used valid UpdraftCentral keys to install backdoors on connected WordPress sites; the company reset credentials and released updates.
Key points
- TeamUpdraft said it detected unauthorized access to teamupdraft.com over October 17–18, 2026, and believes attackers accessed its customer database.
- Patchstack observed attackers using valid UpdraftCentral keys to send commands that uploaded and activated backdoor plugins on connected WordPress sites.
- Nethemba described a backdoor that could create a WordPress account with elevated permissions; the account could remain after the plugin was removed.
- Patchstack reported observing 99 distinct backdoor plugin names during an 18-hour campaign on October 18–19.
- TeamUpdraft closed the access route, signed out accounts, replaced potentially affected keys and credentials, and released UpdraftPlus versions 1.26.13 and 2.26.13 to disconnect older UpdraftCentral connections.
- The vendor advised affected users to change reused passwords, reset 2FA, and reconnect cloud services or replace UpdraftClone keys; it said the UpdraftPlus plugin and self-hosted services were not impacted.
Article Details
- Victim Organization
- TeamUpdraft
- Victim Domain
- teamupdraft.com
- Incident Type
- Unauthorized access to TeamUpdraft's website, with potential access to customer connection keys and observed use of valid UpdraftCentral keys to install backdoor plugins on connected WordPress sites.
- Incident Date
- 2026-10-17
- Data Types Exposed
- UpdraftCentral, UpdraftVault, and UpdraftClone customer connection keys (potentially accessed)
- Customer database information (access believed to have occurred; specific fields not provided)
- Operational Impact
- TeamUpdraft closed the access route, signed out accounts, replaced potentially affected keys and credentials, and released UpdraftPlus updates to disconnect older UpdraftCentral connections. Patchstack observed commands installing backdoor plugins on connected WordPress sites during an 18-hour period on October 18–19, 2026. Nethemba reported that a working backdoor could create or access an administrator account and persist after plugin removal.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | rank1cdn[.]com | Domain the separately described Rank Math PRO malware may communicate with; not identified as infrastructure used in the TeamUpdraft incident. |
MITRE ATT&CK
CVE
People
Vendors
Products
UpdraftCentralUnknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.UpdraftCloneUnknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.UpdraftPlusTeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote management service that's used for managingUpdraftVaultUnknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.WordPressUnknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.