Unauthorised UpdraftCentral plugin uploads on five sites

Hello TeamUpdraft,

I am reporting an incident affecting five WordPress sites under my administration on 19 October 2026. I am omitting site names, account identifiers and private evidence from this public post.

Our findings:

• Local UpdraftCentral logs on all five sites record “Command received: plugin.upload_plugin”, corresponding in time to HTTP POST requests and the appearance of malicious plugins.
• The requests came from the same IPv6 address reported in the linked discussion, with the User-Agent “WordPress/6.4; class-udrpc.php”. The User-Agent alone is not proof of origin; our correlation also includes the internal command logs and the files found.
• Before the uploads, the logs show rejected probe messages referring to probe.central.updraftplus.com. The upload events refer to the existing 0.central.updraftplus.com connection.
• These were previously authorised UpdraftCentral connections, created months before the incident. I am the only authorised user of the associated TeamUpdraft account.
• The uploaded plugins contain code intended to create privileged accounts and/or authenticate as existing administrators. Some caused fatal errors because of undefined class constants. The specific usernames targeted by the malicious code were absent when we checked the databases; this does not exclude other misuse.

UpdraftPlus 1.26.11 is currently installed on the four retained sites. On two sites, the inspected RPC files have modification dates preceding the attack. We did not capture every site’s exact code state at the time of the requests, so we are not claiming that the current version proves which version handled every attack.

Containment: all five malicious plugins quarantined, the remaining UpdraftCentral connections revoked, WordPress sessions invalidated, and TeamUpdraft account 2FA subsequently enabled. Evidence has been preserved privately. One affected site was retired separately.

A detailed private report has already been submitted through the TeamUpdraft support form, with an event chronology and relevant HTTP request extracts. No sensitive archive was attached. I am posting here because your support instructions direct free-plugin users to this forum. I do not yet have a verified ticket reference or response.

Could your security team please confirm whether this pattern is being investigated, identify any additional remediation required, and explain when it is safe to establish new UpdraftCentral connections? Please also preserve relevant hosted-service logs and investigate whether existing connection credentials could have been misused and whether backups or other data were accessed.

The initial cause remains undetermined. We are not asserting that TeamUpdraft’s infrastructure was compromised or that a particular vulnerability has been established.

Thank you.