TeamUpdraft, maker of the UpdraftPlus backup plugin, says it found unauthorized access to teamupdraft.com over the weekend of Oct 17–18 and believes its customer database was accessed. That database held names, emails, billing addresses, order history, hashed passwords, two-factor settings, and the connection keys for UpdraftCentral (its cloud remote-management dashboard), UpdraftVault and UpdraftClone. The company says no card data was stored, the UpdraftPlus plugin and its downloads weren't affected, and self-hosted UpdraftCentral isn't affected. It has reported the incident to the UK ICO.

Those keys are already being abused. Nethemba, Patchstack and Wordfence report that an attacker sent correctly signed UpdraftCentral plugin.upload_plugin commands to connected sites, which installed and often activated backdoor plugins, including on sites fully patched against June's CVE-2026-10795. Patchstack counted 99 different backdoor plugin names installed in about 18 hours on Oct 18–19. The backdoors log the attacker in from a secret URL parameter, and some variants also create a hidden Editor or admin account. Nethemba says the attacker was still sending commands on Oct 19 and swapped broken backdoors for working ones. Only sites with a cloud UpdraftCentral connection key are exposed. UpdraftPlus has more than 4 million installs, and Nethemba cites the vendor's June estimate that under 10% have an UpdraftCentral or Migrator key.

Do now: update to UpdraftPlus 1.26.13 (free, on wordpress.org since Oct 19) or 2.26.13 (Premium). Nethemba reports that 1.26.12 / 2.26.12, the versions in the vendor's notice, don't actually delete the old keys, and that even 1.26.13 misses keys created between 12:07 and 21:00 UTC on Oct 18. Delete the UpdraftCentral key on each site anyway (Settings → UpdraftPlus → Advanced Tools → UpdraftCentral, or wp option delete updraft_central_localkeys). Then check for plugins and users you don't recognise, change admin and teamupdraft.com passwords, and reset TeamUpdraft 2FA. If a backdoor ran, treat the site as compromised and restore from a backup taken before Oct 17. Wordfence has pushed an emergency firewall rule to free users that blocks UpdraftCentral commands. Not a CVE and not in CISA KEV; this is a vendor breach with stolen keys, not a plugin bug.