UpdraftCentral Cloud Keys Are Installing Malware - Floor UpdraftPlus 1.26.13

The Situation

TeamUpdraft published a customer incident page on 19 October 2026 (last updated 19 October 2026 19:03 BST). Their words, not ours: over the weekend of 17-18 October they identified unauthorised access to teamupdraft.com, they believe the customer database was accessed, and that database held names, emails, billing addresses, order history, hashed passwords, 2FA settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. They say they do not store card details (Stripe / PayPal). They say the UpdraftPlus plugin packages were not affected, third-party remote storage (Google Drive / Dropbox / S3) was not affected by the website breach itself, and self-hosted UpdraftCentral is not affected.[1]

Wordfence’s PSA (datePublished 2026-10-19T20:02:56+00:00) is the operator-facing piece: public analysis by Nethemba plus reports sent to Wordfence document attackers using valid UpdraftCentral connection keys to send remote commands that uploaded, activated, and deleted malicious plugins. Because those requests were properly signed, an UpdraftPlus install that already had the June CVE-2026-10795 auth-bypass fix could still treat them as legitimate UpdraftCentral instructions. Wordfence names the command used in publicly analysed attacks: plugin.upload_plugin. Where the WordPress user who created the connection could install plugins, that is PHP on disk.[2][3]

This is not “every UpdraftPlus site.” Wordfence’s own scope: the UpdraftCentral client ships in Free and Premium, but it does not accept commands unless a connection key exists on the site. Highest risk: sites connected to TeamUpdraft’s cloud-hosted UpdraftCentral. Free users without a teamupdraft.com account are told by the vendor they do not need to act for this incident - still update the plugin.[1][2]

wordpress.org plugin API this morning: slug updraftplus, current version 1.26.13, last_updated 2026-10-19 8:57pm GMT, active_installs 4000000. Plugin directory page: 4+ million active installations, tested up to WordPress 7.1.3. That is an install count, not a count of cloud-connected sites.[4]

CISA KEV catalog 2026.10.16 (count 1748) does not list this incident. Newest dateAdded rows remain BeyondTrust CVE-2026-102764 and Fortinet CVE-2025-61624. There is no new CVE ID for the teamupdraft.com database access in the vendor page or the Wordfence PSA.[5][1][2]

What actually happened (and what did not)

UpdraftCentral is remote management: backups, plugins, themes, users. Site and dashboard share cryptographic keys. UpdraftPlus then runs commands signed by the trusted dashboard key as the WordPress user who created the connection.[2]

Wordfence: a request signed with an exposed key passes the plugin’s normal checks. That is stolen credentials, not a fresh unauthenticated bypass in 1.26.11. They explicitly contrast this with CVE-2026-10795 (June 2026 unauthenticated operations on sites that already had a Migrator or UpdraftCentral key) - patched in 1.26.5. Being on a post-10795 build does not stop a stolen cloud key.[2][4]

Wordfence customer reports they cite: malicious plugin installs on UpdraftPlus Premium 2.26.11.x and on a site running Free 1.26.10 or 1.26.11. That is “patched plugin, still owned,” if the cloud key was in the leaked set.[2]

Vendor containment they list: closed the access route, signed out every teamupdraft.com account, released 1.26.12 / 2.26.12 to disconnect UpdraftCentral connections made before 22:00 BST on 18 October, disconnected every UpdraftVault site, replaced every UpdraftClone client key, rotated payment-provider keys, extra monitoring, reported to the UK ICO.[1]

1.26.13 (same day, later): wordpress.org changelog line, theirs: “FIX: Properly apply the revocation in 1.26.12.” 1.26.12’s line: “SECURITY: Revokes UpdraftCentral Cloud keys created before the incident described at https://teamupdraft.com/blog/security-incident-october-2026/.” Paid numbering is first digit +1 (Free 1.26.13 ↔ Premium 2.26.13). The vendor incident page still names 1.26.12 / 2.26.12 because that page’s last updated (19:03 BST) is before the 1.26.13 upload (20:57 BST / 8:57pm GMT). Floor for operators: 1.26.13 / 2.26.13, not 1.26.12.[1][4]

Wordfence shipped an emergency WAF rule that blocks inbound UpdraftCentral UDRPC requests on Free ≤ 1.26.11 and Premium before 2.26.12, and pushed it to Wordfence Free hours after Premium. They say it does not touch ordinary backups or third-party storage. It does block legitimate cloud UDRPC until you are on 1.26.12+. A WAF rule is not a version bump and does not unwind a plugin that already landed.[2]

Hunt the fleet - keys, then the floor

Inventory is the plugin file and whether a local UpdraftCentral key exists. Do not dump updraft_central_localkeys into tickets or chat - it is key material.

# one site (wp-cli). Login to THIS dashboard, not via UpdraftCentral.
wp plugin get updraftplus --field=version --path=/home/USER/public_html

# is a local UDC key present? 0 = none. Do not print the option value.
wp eval 'echo is_array($k=get_option("updraft_central_localkeys"))?count($k):0;' --path=/home/USER/public_html

# cPanel box, every account (read-only versions)
find /home -path '*/wp-content/plugins/updraftplus/updraftplus.php' 2>/dev/null \
  | while read -r f; do
      ver=$(awk -F': ' '/^[[:space:]]*\*?[[:space:]]*Version:/{print $2; exit}' "$f")
      echo "$ver  $f"
    done

Floor:

# from the site’s own dashboard / wp-cli - not through UpdraftCentral
wp plugin update updraftplus --path=/home/USER/public_html
wp plugin get updraftplus --field=version --path=/home/USER/public_html
# expect 1.26.13 or newer (Premium: 2.26.13)

Dashboard path if no wp-cli: Settings → UpdraftPlus → Advanced Tools → UpdraftCentral. If it shows Manage existing keys (N) with N ≥ 1, treat the site as in-scope even if you “never used Central.” Wordfence: 1.26.11 offers “add this site to UpdraftCentral” when connecting a TeamUpdraft account, selected by default.[1][2]

Until 1.26.13 is on disk:

• Delete every local connection key on the site (vendor + Wordfence). Deleting the site only from the cloud dashboard does not remove the local key.[1][2]
• Refresh Wordfence firewall rules if you run it. That is containment for future UDRPC, not forensics.[2]
• upcp / Plesk / EasyApache will not bump this plugin.

After the floor: the update disconnects old cloud keys. It does not remove a plugin, user, MU-plugin, or cron an attacker already planted. Wordfence: if you find anything, restore from a backup before 17 October 2026 when you have one.[1][2]

IoCs Wordfence published (hunt, don’t treat as complete)

All of these are Wordfence / Nethemba, labelled as such. Absence does not prove clean. The second malware variant can hide an administrator or reuse the first existing admin without a new user.[2]

Network:

• 43.250.53.42
• 2a09:bac5:4e21:2e3c::49b:9
• User-Agent exactly WordPress/6.4; class-udrpc.php (legitimate TeamUpdraft UAs in Nethemba’s sample included a UDRPC library version and teamupdraft.com - attackers can change this)

Plugin description / names (first family; names randomise):

• Description: Small maintenance toolkit: keeps option storage tidy.
• Example names: Load Stack 35C, Text Gantry Eb0, style-bridge-8f5, plus reports of speed-press-23b, hero-bridge-6c9, site-health-6a20, db-works-7dba, cache-frame, site-engine

SHA-256 of specific files Wordfence listed (will miss renamed samples):

• opt4fix 2.9.2: 54ca7b2da87852a5d1fd7bde644027f84557db4d45fbb25cb2d135a3497d8d5c
• js-fix-757a 2.8.3: 2cdf3f2a3f10f0e12f00f2267907d44796107ab4aececdac520bba13e012b47a
• lazy-tool-3055 1.3.8: 1821a58e2a851acd1a608a77ce2f77817a0b7b6ef344b9889c8f8728e62969ec
• cache-smith 1.3.1: 43dc88fd18501be3dbd6d7f1755e77386d081dd41cef82bc514d39991ae69c49
• style-bridge-8f5 2.6.6: 0290c2baa363eac72ef2b6891bef1c9c8b4774d5b95d14f4871bde6094fdacde
• style-bridge-8f5/uninstall.php: 99a7fb44d1502938a40b3f663f4e5771b5cf741bcbaec58d7dda0b5066b5a0a5

Users / options:

• Display name Site Tools; usernames like data-ops43, media-staff96, site_editor784, site.crew51, web_desk9
• Emails @example.org / @example.com
• Option names ending _sync_token, _uid, _installed
• Code-level in the working variant: wp_set_auth_cookie() after hash_equals() on a query-string value; pre_user_query / pre_count_users to hide an account

Filesystem: inspect wp-content/plugins, mu-plugins, drop-ins (advanced-cache.php, object-cache.php, db.php, sunrise.php) via SSH/SFTP, not only wp-admin → Plugins. Some samples 500’d; a site that “looks fine” is not a clean bill.[2]

Also from the vendor, for every teamupdraft.com account: change that password from a typed URL (not a mail link), change it anywhere reused, reset TeamUpdraft 2FA. Vault users must reconnect; Clone client keys were rotated.[1]

Honesty / What We Could Not Verify

• We did not replay UDRPC or install a plugin. No signed request, no plugin.upload_plugin payload.
• No CVE ID for the 17-18 Oct website/database access in the vendor page or Wordfence PSA. Do not invent one. CVE-2026-10795 is the June plugin bug, already in 1.26.5+.[1][2][4]
• Not on CISA KEV as of catalog 2026.10.16 / count 1748.[5]
• 4,000,000 active_installs is wordpress.org’s API figure this morning. It is not “4 million sites with a leaked cloud key.” Exposure needs an on-site connection key for cloud Central.[2][4]
• Wordfence did not publish a victim count. They cite Nethemba plus “multiple customer reports.” We are not turning that into a campaign size.[2]
• Vendor page still says floor 1.26.12. Changelog 1.26.13 says 1.26.12’s revocation did not apply properly. We are flooring 1.26.13 / 2.26.13 from the plugin API + changelog, and labelling the page lag.[1][4]
• Plugin zip supply chain: TeamUpdraft says packages were not affected. Wordfence repeats that. We did not checksum historical zips.[1][2]
• Self-hosted UpdraftCentral: vendor says not affected by the teamupdraft.com compromise. We did not audit self-hosted dashboards.[1]
• IoC list is incomplete by Wordfence’s own wording. Second variant changes names/descriptions; IP/UA block is not sufficient.[2]

What this is not

• Not CVE-2026-104736 (LearnPress checkout-email object injection). Different plugin.
• Not CVE-2026-93953 (Backuply restore SQLi). Different backup plugin.
• Not Rank Math SEO PRO 3.0.123 malware (15-16 Oct download window). Different vendor, supply-chain zip, not Updraft keys.
• Not WordPress Core CVE-2026-87902 (KEV 25 Sep).
• Not today’s KEV (BeyondTrust Remote Support, Fortinet path traversal).
• Not “every site with UpdraftPlus Free is owned.” Need a cloud UpdraftCentral key on the site during the incident, per Wordfence/vendor.
• Not a cPanel/WHM bug. Patch the plugin; upcp will not do it.

Sources

[1] https://teamupdraft.com/blog/security-incident-october-2026/ - TeamUpdraft incident page (last updated 19 Oct 2026 19:03 BST) [2] https://www.wordfence.com/blog/2026/10/updraftcentral-connection-key-compromise/ - Wordfence PSA 2026-10-19T20:02:56+00:00 [3] https://nethemba.com/updraftcentral-backdoor-analysis/ - Nethemba public analysis (cited by Wordfence) [4] https://wordpress.org/plugins/updraftplus/ - UpdraftPlus 1.26.13 / API active_installs 4000000, last_updated 2026-10-19 8:57pm GMT [5] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - CISA KEV JSON catalog 2026.10.16 [6] https://www.wordfence.com/blog/2026/06/critical-unauthenticated-authentication-bypass-vulnerability-patched-in-updraftplus-wordpress-plugin/ - CVE-2026-10795 context (June; not this incident)