Loading story…
Attackers used compromised UpdraftCentral connection keys to install malicious plugins on connected WordPress sites after unauthorized access to teamupdraft.com on October 17–18, 2026. TeamUpdraft believes attackers accessed a customer database containing account information and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Valid keys allowed trusted remote commands to pass authentication checks, including on sites with the earlier CVE-2026-10795 fix. Exposure primarily concerns sites connected to cloud-hosted UpdraftCentral—not every UpdraftPlus installation. TeamUpdraft says plugin downloads, self-hosted UpdraftCentral installations, and backups stored with third-party providers were not affected by the vendor compromise.
TeamUpdraft released UpdraftPlus Free 1.26.12 and Premium 2.26.12 to disconnect older connections, and Wordfence deployed an emergency firewall rule blocking the affected command channel. Observed malicious plugins could execute PHP, grant elevated capabilities, conceal administrator accounts, or authenticate attackers as existing administrators. Updating or blocking further commands does not remove an existing compromise. Previously connected sites should have old connection keys removed and credentials reset, undergo investigation beyond the WordPress dashboard, and be restored or thoroughly remediated before reconnecting.
See attribution, scope, and your downstream exposure.
10 events from the most recent confirmed update back to the earliest known activity.
UpdraftPlus Free 1.26.13 and Premium 2.26.13 corrected the key-removal behavior introduced in version 1.26.12. Nethemba reported a cutoff mismatch that could leave some exposed UpdraftCentral keys present, making manual verification important.
Nethemba's public analysis and reports submitted to Wordfence documented the malicious-plugin campaign, with published findings including network indicators, plugin names, and file hashes. Analyzed malware could grant elevated capabilities, conceal administrator accounts, or authenticate attackers as an existing administrator without creating a new account.
TeamUpdraft disconnected all UpdraftVault sites and issued replacement credentials, requiring users to reconnect before backups could resume. It also replaced all UpdraftClone client keys, invalidating old keys.
TeamUpdraft reported fixing the underlying weakness, signing out accounts, rotating affected credentials and connected-service keys, and adding monitoring. It also notified the UK Information Commissioner's Office.
Attackers used valid connection keys to upload, activate, and delete malicious plugins through trusted remote commands on connected WordPress sites. Reported compromises included recent UpdraftPlus installations containing the earlier CVE-2026-10795 fix, which did not prevent commands signed with compromised keys.
Wordfence released an emergency firewall rule to Premium, Care, and Response customers and extended it to Free users a few hours later. The rule blocked inbound UpdraftCentral UDRPC requests on affected UpdraftPlus versions, stopping legitimate and malicious commands without disrupting ordinary backups or restores.
TeamUpdraft released UpdraftPlus Free 1.26.12 and Premium 2.26.12 to automatically disconnect UpdraftCentral connections created before 21:00 UTC on October 18, 2026. Connections subsequently created through its manual reconnection procedure were preserved; the updates did not remove existing malware.
TeamUpdraft published its incident advisory on October 19, 2026, describing the unauthorized access and suspected customer-database exposure. It said plugin downloads, self-hosted UpdraftCentral installations, and backups in customers' third-party storage were not affected by the vendor compromise.
User mvwautotechniek reported that three WordPress installations running UpdraftPlus 1.26.11 were compromised on October 19, 2026, with unauthorized plugins containing administrator-access backdoors. Each site's UpdraftCentral logs recorded plugin.upload_plugin commands; a fourth installation without UpdraftPlus showed no evidence of the attack.
Unauthorized access to teamupdraft.com occurred during October 17–18, 2026. TeamUpdraft believes attackers accessed its customer database, which contained account information, password hashes, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
16 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcecert.ug
Open sourcescworld.com
Open sourcesh3llc0d3.com
Open sourcewordpress.org
Open sourcewordpress.org
Open sourcenethemba.com
Open sourcewordpress.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass in the **UpdraftPlus: WP Backup & Migration** WordPress plugin, tracked as `CVE-2026-10795`, is being actively exploited against sites running versions up to and including `1.26.4`. The flaw affects a plugin installed on more than three million WordPress sites and stems from insufficient validation in UpdraftCentral remote procedure call handling, including signature-verification weaknesses and unchecked decryption return values that can collapse to a predictable all-zero key. Wordfence reported blocking **4,987** exploitation attempts in a 24-hour period. Successful exploitation lets unauthenticated attackers impersonate the connected administrator and issue arbitrary RPC actions, including uploading and auto-activating a malicious plugin for **remote code execution** and full site compromise. The vulnerability has been classified under `CWE-347`, with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The issue was reportedly discovered by researcher **vtim**, and the vendor released a patch that adds stricter return-value validation; administrators are being urged to update immediately.
Jun 18, 2026
A supply-chain compromise of ShapedPlugin’s premium WordPress plugin distribution inserted backdoor code into official paid releases, allowing unauthenticated attackers to fully compromise affected websites. Wordfence said the attackers tampered with the vendor’s update pipeline used for Pro builds distributed via Easy Digital Downloads, while free versions in the WordPress repository were not affected. Confirmed malicious releases included **Smart Post Show Pro** `4.0.1`, **Product Slider for WooCommerce Pro** `3.5.2`, and **Real Testimonials Pro** `3.2.4`, which were later replaced by clean versions `4.0.2`, `3.5.3`, and `3.2.5`; the incident is tracked as **`CVE-2026-10735`** with a reported **CVSS 9.8**.
Jun 16, 2026
A supply-chain attack hit the **Essential Plugin** WordPress portfolio after the plugin business was reportedly acquired by a new owner who inserted a hidden backdoor into trusted add-ons used by thousands of websites. Researchers said the malicious code was added to `Countdown Timer Ultimate` version `2.6.7` in August 2025 as a PHP deserialization backdoor, then left dormant for about eight months before activating in early April 2026. Once triggered, affected sites contacted `analytics.essentialplugin.com`, received additional payloads, and had malicious code written into `wp-config.php`. The compromise allowed attackers to serve hidden spam links, fake pages, and redirects to Googlebot while remaining largely invisible to site owners. WordPress.org subsequently closed all **31** Essential Plugin entries in the plugin directory and pushed version `2.6.9.1` to remove the phone-home behavior, but reports warned that the update did **not** clean already-compromised `wp-config.php` files. Hosting providers and researchers urged administrators to manually inspect and remove any still-installed malicious plugins and persistence left on their servers, underscoring the risk that plugin ownership changes can turn established WordPress software into a malware distribution channel.
Apr 15, 2026