PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites

TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information.

Public analysis by Nethemba and reports submitted directly to Wordfence have documented attackers using valid UpdraftCentral connection keys to send remote commands to connected WordPress sites. Those commands were used to upload, activate, and delete malicious plugins. Because the requests were properly signed with trusted keys, an UpdraftPlus installation that contained the earlier CVE-2026-10795 security fix could still accept them as legitimate UpdraftCentral instructions.