● Covered by 2 sources · 2 reportsMedium impact2 negative
TeamUpdraft Breach Exposes Customer Data and UpdraftCentral Connection Keys
Key points
- TeamUpdraft website breached on October 17-18.
- Customer database accessed, exposing names, emails, billing, order history, and hashed passwords.
- UpdraftCentral connection keys potentially compromised.
- Threat actors are using stolen keys to backdoor WordPress sites.
- TeamUpdraft closed access, signed out accounts, and replaced affected keys.
Unauthorized Access Detected
TeamUpdraft, the developer behind WordPress plugins such as UpdraftPlus, UpdraftCentral, UpdraftVault, and UpdraftClone, identified unauthorized access to its teamupdraft.com website during the weekend of October 17-18. The company's team responded immediately to contain the breach, closing the access route, signing out all accounts, and replacing potentially affected keys and credentials.
Customer Data Compromised
The breach is believed to have resulted in threat actors accessing TeamUpdraft's customer database. This database contained customer details including names, email addresses, billing addresses, and order history. Account passwords, stored in hashed form, were also accessed, along with two-factor authentication (2FA) settings.
UpdraftCentral Keys Exploited
A significant concern from the breach is the potential compromise of UpdraftCentral connection keys. UpdraftCentral is a service for remotely managing multiple WordPress sites, and its client component is included with UpdraftPlus, which has over 4 million active installations. Reports indicate that threat actors are using these stolen connection keys to plant backdoors on connected WordPress sites.
Impact on WordPress Sites
The exploitation of UpdraftCentral keys poses a risk to WordPress sites managed through the service. The keys allow commands to be sent to connected websites, enabling unauthorized access and potential compromise. TeamUpdraft's swift action to replace keys and credentials aims to mitigate further unauthorized access.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-107958.1 HIGH CVE CVE-2026-1118629.8 CRITICAL CVE CVE-2026-1096189.8 CRITICAL CVE CVE-2026-1096198.1 HIGHHow outlets covered it
TeamUpdraft, developer of the UpdraftPlus WordPress plugin, experienced a security breach that exposed customer data and UpdraftCentral connection keys. Attackers used these keys to backdoor WordPress sites, prompting TeamUpdraft to reset credentials and release updated plugin versions.
TeamUpdraft, developer of popular WordPress plugins, experienced a data breach compromising customer data, including password hashes and UpdraftCentral connection keys. Threat actors are reportedly using these stolen keys to backdoor WordPress sites, potentially affecting hundreds of thousands of websites.