According to Bleeping Computer, a threat actor breached the infrastructure of TeamUpdraft, a developer of popular WordPress backup and security plugins, potentially compromising connection keys used to manage remote websites.
The breach occurred over the weekend of Oct. 17-18, 2026, allowing unauthorized access to customer databases. Stolen data includes password hashes, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. While plugin files remain secure, the incident has a significant impact, with an estimated 400,000 websites potentially exposed. Researchers at Patchstack and Nethemba confirmed that attackers are using these stolen keys to install malicious backdoor plugins and create unauthorized administrator accounts. Despite the vendor releasing security updates, initial efforts to revoke keys were hindered by technical bugs. Users are urged to update to version 1.26.13 or 2.26.13 and manually delete existing connection keys within their WordPress settings. Security experts advise administrators to audit logs for suspicious activity and restore sites from clean backups if a compromise is detected. This event highlights the risks associated with remote management tools, as attackers can bypass standard server defenses by utilizing valid credentials to execute arbitrary code across multiple connected WordPress environments.
Source: Bleeping Computer
