News: Critical Security Advisory: UpdraftCentral Connection Key Compromise – What WordPress Site Owners Should Do Now

Overview

HostFe is issuing an important security advisory following a confirmed security incident involving TeamUpdraft, the developer of the widely used WordPress backup plugin UpdraftPlus and its remote management platform, UpdraftCentral.

Between October 17 and 19, 2026, unauthorized access to TeamUpdraft's infrastructure potentially exposed sensitive account information and UpdraftCentral connection keys.

Security researchers subsequently identified attackers exploiting compromised connection keys to remotely install malicious plugins, create unauthorized WordPress users, and establish persistent backdoor access to affected websites.

All HostFe customers using UpdraftPlus or UpdraftCentral are strongly advised to review their WordPress installations and take immediate precautionary action.

What Happened?

UpdraftCentral allows WordPress administrators to remotely manage websites, perform updates, install plugins, and execute administrative tasks through authenticated connections.

Following the reported security breach, attackers obtained access to valid connection keys and used them to send unauthorized commands to connected WordPress websites.

These attacks could allow malicious actors to:

• Install unauthorized plugins containing malicious code.

• Create hidden or unauthorized WordPress user accounts.

• Obtain administrative capabilities without normal authentication.

• Maintain persistent access to compromised websites.

• Modify website files, configurations, or stored information.

Importantly, this incident concerns compromised remote management credentials rather than a vulnerability in the UpdraftPlus plugin code itself.

TeamUpdraft has confirmed that its official plugin downloads and self-hosted UpdraftCentral installations were not affected by this incident.

Immediate Security Actions Required

HostFe recommends that customers complete the following security checks immediately.

1. Update UpdraftPlus

Access your WordPress dashboard and navigate to Plugins → Installed Plugins.

Ensure UpdraftPlus is updated to at least:

• UpdraftPlus Free: Version 1.26.13

• UpdraftPlus Premium: Version 2.26.13

Install any newer security releases available.

These updates revoke affected older UpdraftCentral connections, helping prevent unauthorized commands through the compromised keys.

2. Remove Existing UpdraftCentral Connection Keys

Navigate to:

WordPress Dashboard → Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral

Locate Manage existing keys and remove any existing connection keys.

Even if you do not actively use UpdraftCentral, verify that no connection keys are stored.

Removing UpdraftCentral connections does not disable the normal UpdraftPlus backup functionality.

3. Inspect WordPress Users

Navigate to Users → All Users and carefully review all accounts.

Pay particular attention to unfamiliar Administrator or Editor accounts. Security researchers have identified malicious accounts disguised as ordinary Editors while possessing elevated administrative capabilities.

Remove unauthorized accounts after preserving relevant evidence and verifying that they are not legitimate users.

4. Inspect Installed Plugins

Review all installed WordPress plugins, including Must-Use plugins and any recently added files.

Researchers have identified suspicious plugins using names such as Site Health Cache, alongside numerous other randomly generated plugin names.

Investigate unfamiliar plugins, especially those installed between October 18 and 19, 2026.

5. Reset Passwords and Review Sessions

Change passwords for WordPress administrators and your TeamUpdraft account.

Where appropriate, reset two-factor authentication, terminate existing sessions, and review other credentials accessible to the website.

6. Scan Your Website for Malware

Perform a comprehensive security assessment of your WordPress installation.

If suspicious activity is identified, isolate the affected website and investigate the extent of the compromise.

Important: Updating UpdraftPlus does not automatically remove malicious plugins or unauthorized accounts that attackers may have installed before the connection keys were revoked.

7. Restore From a Verified Clean Backup if Necessary

If your website has been compromised, consider restoring it from a verified clean backup created before October 17, 2026.

After restoration, apply the latest security updates, revoke old connection keys, rotate affected credentials, and confirm that the website is clean before returning it to normal operation.

Additional Advisory for UpdraftVault Users

TeamUpdraft has also reset UpdraftVault connections as a precaution.

Customers using UpdraftVault should reconnect their remote backup storage and verify that scheduled backups are functioning correctly.

Customers relying on UpdraftClone should also review the vendor's instructions for replacing affected client keys.

HostFe Security Advisory

At HostFe, protecting hosting infrastructure and customer websites remains a key priority.

We strongly encourage all customers to maintain updated WordPress installations, regularly review administrative access, monitor installed plugins, and maintain independent, verified backups.

Please note: This is a third-party security incident involving TeamUpdraft and does not, by itself, indicate a compromise of HostFe's hosting infrastructure.

Customers who identify unauthorized plugins, unfamiliar administrator accounts, or unexpected website modifications should immediately contact HostFe Technical Support through their client area.

Official Security References

TeamUpdraft Security Incident Disclosure:
https://teamupdraft.com/blog/security-incident-october-2026/

Patchstack Security Research:
https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/

HostFe Security Team