Attackers holding stolen UpdraftCentral dashboard keys are pushing backdoor plugins straight onto WordPress sites that run UpdraftPlus, the backup plugin active on more than 4 million installs. Patchstack logged the campaign running from October 18 into October 19, 2026, and rates it CVSS 9.8. There’s no patch for this one. The attacker’s commands carry genuine, correctly signed UpdraftCentral keys, so every check UpdraftPlus runs passes.
What’s Actually Happening
UpdraftCentral is the remote management channel built into every copy of UpdraftPlus, free and premium. Connect a site to it once and it gets a private key that lets a dashboard push commands like backups, restores, and plugin installs. According to Patchstack’s advisory, someone is now sending plugin.upload_plugin commands signed with keys that were never supposed to leave TeamUpdraft’s cloud infrastructure, and those keys don’t expire. Patchstack found keys issued back in November 2025 still working against live sites in October 2026.
Researchers at Nethemba were first to document it. Their write-up traces the attack to a single IP address sending upload commands to three sites overnight on October 19, with two of the three successfully infected. Patchstack says its own telemetry shows a wider campaign across its customer base, with the attacker rotating source IPs as blocks go up.
What the Backdoor Plugin Does
The planted plugin is disguised with a generic name and a bland description, something like “Small maintenance toolkit: keeps option storage tidy.” Patchstack has catalogued close to 99 different plugin names used across the campaign, with “Site Health Cache” showing up most often. Once active, it hooks early into every request and waits for a secret URL parameter. Hit it with the right token and the plugin creates a hidden account, grants it Editor role plus manage_options and install_plugins, and logs that session in through a persistent cookie that skips the login form entirely, so two-factor and login-attempt limits never run.
The account survives even after you delete the plugin. Some samples in the wild have a coding bug that throws a 500 error on uncached requests, which is apparently how several site owners first noticed something was wrong. Don’t try to patch that bug yourself if you find one: Patchstack warns that fixing the error is what activates the backdoor.
This Isn’t the Same Flaw UpdraftPlus Already Patched
UpdraftPlus did fix a serious UpdraftCentral issue back in June, around the same period core shipped its own file-inclusion fix: CVE-2026-10795, CVSS 8.1, where a broken decryption fallback let attackers forge commands with no keys at all. That one’s fixed in 1.26.5. This is a different problem. It’s a credential compromise, not a code bug, so updating UpdraftPlus does nothing to stop it. A site can be fully patched and still get hit if it’s holding a live UpdraftCentral key.
What to Do Right Now
- Check for an active key, even if you’ve never knowingly used UpdraftCentral: run
wp option get updraft_central_localkeys, or check Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral in wp-admin. - Delete every key you find. Removing the site from a UpdraftCentral dashboard isn’t enough, the key lives on the site itself. Scheduled backups keep running fine without it.
- Hold off reconnecting until TeamUpdraft explains where the keys leaked from. The connection screen enrolls new sites by default through a checkbox that ships pre-checked.
- If you find a suspicious plugin with a vague maintenance-sounding name: deactivate it and move it out of the web root rather than deleting it through wp-admin, delete any
_sync_tokenoption it left behind, and remove the backdoor account. - If a hidden account or the trigger parameter shows up in your access logs, treat the site as fully compromised: restore from a backup taken before the intrusion, diff files against a clean install, audit every user with elevated capabilities, and rotate admin and UpdraftCentral Cloud passwords.
This campaign is a reminder that plugin security isn’t only about patch levels. A site running the latest version of every plugin can still be wide open through a remote-management key nobody remembered existed, which is exactly the kind of exposure that recent hidden-admin-backdoor campaigns and persistent WordPress backdoors keep exploiting. For agencies managing client sites, a periodic audit as part of ongoing WordPress development and maintenance work is what actually catches a dormant key like this before it turns into a full takeover.
