As cited
Copy frozen at (site build).
vulnerabilities
Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
Attackers stole UpdraftCentral dashboard keys from the vendor's cloud environment and used them to deploy backdoor plugins on over four million connected WordPress sites between October 18-19, 2026. The backdoors created hidden editor accounts that bypass two-factor authentication and allow remote code execution. No vendor patch addresses the key compromise itself; the fix requires deleting UpdraftCentral keys from affected sites.
Why it matters: WordPress site administrators running UpdraftPlus with active UpdraftCentral keys are exposed to site takeover unless they immediately delete their keys; even users who never intentionally enabled UpdraftCentral are at risk due to a default-checked enrollment option.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
Attackers stole UpdraftCentral dashboard keys from the vendor's cloud environment and used them to deploy backdoor plugins on over four million connected WordPress sites between October 18-19, 2026. The backdoors created hidden editor accounts that bypass two-factor authentication and allow remote code execution. No vendor patch addresses the key compromise itself; the fix requires deleting UpdraftCentral keys from affected sites.
Why it matters: WordPress site administrators running UpdraftPlus with active UpdraftCentral keys are exposed to site takeover unless they immediately delete their keys; even users who never intentionally enabled UpdraftCentral are at risk due to a default-checked enrollment option.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
Attackers stole UpdraftCentral dashboard keys from the vendor's cloud environment and used them to deploy backdoor plugins on over four million connected WordPress sites between October 18-19, 2026. The backdoors created hidden editor accounts that bypass two-factor authentication and allow remote code execution. No vendor patch addresses the key compromise itself; the fix requires deleting UpdraftCentral keys from affected sites.
Why it matters: WordPress site administrators running UpdraftPlus with active UpdraftCentral keys are exposed to site takeover unless they immediately delete their keys; even users who never intentionally enabled UpdraftCentral are at risk due to a default-checked enrollment option.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
Attackers stole UpdraftCentral dashboard keys from the vendor's cloud environment and used them to deploy backdoor plugins on over four million connected WordPress sites between October 18-19, 2026. The backdoors created hidden editor accounts that bypass two-factor authentication and allow remote code execution. No vendor patch addresses the key compromise itself; the fix requires deleting UpdraftCentral keys from affected sites.
Why it matters: WordPress site administrators running UpdraftPlus with active UpdraftCentral keys are exposed to site takeover unless they immediately delete their keys; even users who never intentionally enabled UpdraftCentral are at risk due to a default-checked enrollment option.
- Source published
- First seen by Cybersecurity Tracker