TeamUpdraft Breach Exposes WordPress Sites to Remote Takeovers
Attackers used stolen UpdraftCentral keys from a recent TeamUpdraft security breach to install malicious plugins on an estimated 400,000 WordPress websites.
AI-generated editorial illustration. Not a photograph of the event.
THE PRIMARY BRIEF
01 · The primary finding
A security breach at TeamUpdraft exposed UpdraftCentral connection keys, leading to potential compromise of up to 400,000 WordPress sites.
02 · The primary evidence
TeamUpdraft's customer database, containing sensitive information and connection keys, was accessed by attackers on October 17-18, 2026, who then used these keys to install malicious plugins on connected WordPress sites.
03 · Why it matters
This incident is significant because many WordPress users unknowingly have active UpdraftCentral keys, leaving them vulnerable to remote site takeovers.
16 cited sources · 15 independent publishers
A security breach over October 17-18, 2026, allowed attackers to access TeamUpdraft's customer database, exposing UpdraftCentral connection keys and potentially compromising 400,000 WordPress websites. Many WordPress site owners use UpdraftPlus, often unknowingly holding active UpdraftCentral keys, making their sites vulnerable to remote takeovers following this incident.