A security breach involving the UpdraftPlus WordPress backup plugin’s UpdraftCentral feature allowed attackers to install malicious plugins and create unauthorized administrator accounts on millions of websites globally after the plugin developer’s website was compromised.
TeamUpdraft, the plugin’s developer, confirmed its website was compromised between Oct. 17 and 18, 2026, leading to the theft of customer data and crucial UpdraftCentral connection keys, according to a statement from the organization.
Security updates, versions 1.26.13 and 2.26.13 for UpdraftPlus, were released on Oct. 19, 2026, to revoke older UpdraftCentral connections and automatically disconnect affected sites, TeamUpdraft reported.
The security incident was not attributed to a vulnerability within the UpdraftPlus plugin’s core code itself; instead, it was an impersonation attack that leveraged legitimate security keys stolen during the initial compromise of TeamUpdraft’s systems.
Attackers reportedly installed malicious plugins on affected WordPress sites to establish backdoor administrator accounts, effectively bypassing standard login procedures and existing security measures, according to cybersecurity firm Patchstack.
Many websites may have active UpdraftCentral connections without administrators’ explicit knowledge, as the feature was often enabled by default during the plugin’s installation, Patchstack noted.
The UpdraftPlus plugin is widely used, with installations on over 3 million WordPress websites, making the potential impact of the breach extensive.
Source: Search Engine Journal
