{"id":19049036,"date":"2026-10-19T15:12:12","date_gmt":"2026-10-19T15:12:12","guid":{"rendered":"https:\/\/wordpress.org\/support\/?post_type=topic&#038;p=19049036"},"modified":"2026-10-19T17:16:40","modified_gmt":"2026-10-19T17:16:40","slug":"teamupdraft-confirms-security-breach","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/teamupdraft-confirms-security-breach\/","title":{"rendered":"TeamUpdraft Confirms Security Breach"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">TeamUpdraft has now published an official security announcement confirming that its website was accessed without authorisation over the weekend of 17\u201318 October 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Official announcement:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/teamupdraft.com\/blog\/security-incident-october-2026\/\">https:\/\/teamupdraft.com\/blog\/security-incident-october-2026\/<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to TeamUpdraft, its customer database is believed to have been accessed, potentially exposing UpdraftCentral connection keys, along with other account information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This disclosure is particularly significant given the numerous reports here of malicious WordPress plugins being installed through the UpdraftCentral remote management interface on 19 October.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In our own investigation, we confirmed that <strong>eight separate WordPress installations running UpdraftPlus 1.26.11<\/strong> were compromised. The UpdraftCentral logs recorded 12 <code>plugin.upload_plugin<\/code> commands from the same unauthorised IP address, immediately preceding the installation of malicious plugins.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>TeamUpdraft&#8217;s recommended actions for UpdraftCentral Cloud users include:<\/strong><\/p>\n\n\n\n<ol start=\"1\">\n<li>Delete existing UpdraftCentral connection keys from each connected WordPress installation.<\/li>\n\n\n\n<li>Inspect WordPress administrator accounts for unauthorised users.<\/li>\n\n\n\n<li>Inspect installed plugins, including Must-Use plugins, for suspicious additions.<\/li>\n\n\n\n<li>Change WordPress administrator passwords.<\/li>\n\n\n\n<li>Consider restoring compromised websites from backups taken before 17 October.<\/li>\n\n\n\n<li>Reconnect to UpdraftCentral using new connection keys only after securing the installations.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">TeamUpdraft has also announced an emergency UpdraftPlus release intended to automatically invalidate UpdraftCentral connections established before 22:00 BST on 18 October.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> Simply updating UpdraftPlus to version 1.26.11 does not address potentially compromised connection keys. Site administrators should follow TeamUpdraft&#8217;s published security instructions rather than relying on a plugin update alone.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This official disclosure provides a plausible explanation for the attacks reported across multiple WordPress installations, although the precise circumstances surrounding the misuse of individual connection keys have not yet been established.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I encourage everyone using UpdraftCentral Cloud to read TeamUpdraft&#8217;s announcement and take the recommended precautions immediately.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Could the TeamUpdraft team please confirm when the emergency release is available and clarify whether any additional actions will be required from administrators who have already disconnected or deactivated UpdraftPlus?<\/p>\n","protected":false},"template":"","class_list":["post-19049036","topic","type-topic","status-publish","hentry","topic-tag-security-breach"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19049036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19049036\/revisions"}],"predecessor-version":[{"id":19049154,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19049036\/revisions\/19049154"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=19049036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}