WordPress · disclosed 19 October 2026
Stolen UpdraftCentral keys used to plant backdoor plugins
An attacker with leaked UpdraftCentral dashboard keys installed 99 different backdoor plugins on WordPress sites between 18 and 19 October. The plugins create a hidden administrator when visited with a secret parameter.
- Detectable by a website scanNo, server-side only
- Last reviewed23 October 2026
Affected packages
| Package | Affected versions |
|---|---|
updraftplus (with UpdraftCentral connected) | all |
What to do
- If you use UpdraftCentral, update UpdraftPlus, delete and reissue UpdraftCentral keys, and look for unfamiliar plugins (often named 'Site Health Cache') and admin users named like word-word##.
Sources
- Patchstack: Stolen UpdraftCentral keys are backdooring WordPress sites
- The Hacker News: Attackers abuse UpdraftCentral keys to plant backdoors 2026-10-20
We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.