Back wordpress.org

Unauthorised Updraftcentral Key Used To Install Malware Plugins

wordpress.org • October 20, 2026

fozami (@fozami) 19 hours, 14 minutes ago Hello, My site [ redundant link deleted ] was hacked through UpdraftCentral. I have no account on teamupdraft.com and never created an UpdraftCentral key. On 18 Sep 2026 ( 21:06) an UpdraftCentral key was created on my site (user mifozawork) and its public key was sent to teamupdraft.com. On 18 Oct 23:06 UTC and 19 Oct 01:36 UTC, POST requests with the user agent “WordPress/6.4; class-udrpc.php” came from IP 2a09:bac5:4e21:2e3c::49b:9 (Netherlands). Two malicious plugins (“load-fix” and “form-binder-074”) with backdoors were created within 2 seconds of each request. I deleted the key and the plugins and changed all passwords. UpdraftPlus is version 2.26.11.0. Questions: Can the TeamUpdraft team tell me which account owns that key, or me privately? Could this be caused by a vulnerability in UpdraftCentral? I can the server access log privately. Thank you. The page I need help with: [ log in to see the link]

19 hours, 14 minutes ago

My site [ redundant link deleted ] was hacked through UpdraftCentral. I have no account on teamupdraft.com and never created an UpdraftCentral key.

On 18 Sep 2026 ( 21:06) an UpdraftCentral key was created on my site (user mifozawork) and its public key was sent to teamupdraft.com.

On 18 Oct 23:06 UTC and 19 Oct 01:36 UTC, POST requests with the user agent “WordPress/6.4; class-udrpc.php” came from IP 2a09:bac5:4e21:2e3c::49b:9 (Netherlands). Two malicious plugins (“load-fix” and “form-binder-074”) with backdoors were created within 2 seconds of each request.

I deleted the key and the plugins and changed all passwords. UpdraftPlus is version 2.26.11.0.

Can the TeamUpdraft team tell me which account owns that key, or me privately?

Could this be caused by a vulnerability in UpdraftCentral?

I can the server access log privately. Thank you.

The page I need help with: [ log in to see the link]

seahorse70 (@seahorse70) 14 hours, 4 minutes ago Subject: Urgent security incident: unauthorised plugin installed via UpdraftCentral Hello UpdraftPlus Support, I’m reporting a security incident involving a WordPress site. Our website/security provider says that at 07:00 UK time on 19 October 2026 , someone used the site’s UpdraftCentral remote-management connection to install a malicious plugin called “Asset Stack” . The plugin contained a coding error that caused a “critical error” on the site.

14 hours, 4 minutes ago

Subject: Urgent security incident: unauthorised plugin installed via UpdraftCentral

Hello UpdraftPlus Support,

I’m reporting a security incident involving a WordPress site.

Our website/security provider says that at 07:00 UK time on 19 October 2026 , someone used the site’s UpdraftCentral remote-management connection to install a malicious plugin called “Asset Stack” . The plugin contained a coding error that caused a “critical error” on the site.

You must be logged in to to this topic.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

UpdraftCentral Key Compromise Leads to Backdoor Installations on WordPress Sites TeamUpdraft disclosed on October 19, 2026, that an attacker compromised its customer database over the weekend of October 17-18, accessing UpdraftCentral connection keys. These keys have been used to remotely install backdoor plugins on connected WordPress sites, affecting over 100 sites according to hosting provider Levamo. The attack exploited validly signed commands, allowing the malicious plugins to bypass security checks within UpdraftPlus, the widely used backup plugin with over 4 million installations. The attack was confirmed to have occurred continuously from October 18 to 19. TeamUpdraft has since released updates to disconnect compromised keys and is advising users to delete their UpdraftCentral keys. As of October 20, no vendor fix has been implemented to stop the ongoing exploitation. Users are urged to inspect their sites and follow official guidance to mitigate risks. 9 sources 70

Extracted Entities

Unauthorised Updraftcentral Key Used To Install Malware Plugins

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (1)

Domains (1)

IP Addresses (1)

IPv6 Addresses (1)

Platforms (1)