Security Advisory: Active WordPress Infection Campaign Using Stolen UpdraftCentral Keys

‍

‍

An active campaign is installing fake backdoor plugins on WordPress sites using UpdraftCentral connection keys stolen from TeamUpdraft, the company behind the UpdraftPlus backup plugin. Monarx is seeing these installs come from two IP addresses, with plugin folder names that follow a predictable pattern.

Our Engineering team has already built and deployed new detection rules. Every hosting partner running ThreatShield is protected right now, with no need to remove UpdraftPlus or write custom mod_security, WAF or firewall rules.

Severity: Critical
Status: Active campaign
Affected: WordPress sites running UpdraftPlus (free or premium) with an active UpdraftCentral connection key

What happened

Over the weekend of October 17–18, 2026, TeamUpdraft identified unauthorized access to teamupdraft.com. In their security notice, they state the customer database was likely accessed, including connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The UpdraftPlus plugin code and its downloads were not affected.

UpdraftCentral is the remote management service bundled inside every copy of UpdraftPlus. Once a site has a connection key, it will run any correctly signed command it receives, including installing plugins. With the stolen keys, attackers can send commands that the site treats as fully legitimate.

This is not a code vulnerability in UpdraftPlus; it is a key compromise. When a site connects to UpdraftCentral, it stores the dashboard's public key and from then on executes any command signed with the matching private key, with the permissions of the user who created the connection. Nobody approves individual commands, and those private keys live with the UpdraftCentral Cloud service, which is what the breach exposed.

With the stolen keys, the attacker sends a signed "upload plugin" command to the site, and WordPress installs and activates the plugin through its normal installer. Every signature check passes, so updating UpdraftPlus alone does not stop it; deleting the connection key on the site does. Many sites are exposed without their owners knowing, because connecting a TeamUpdraft.com account from within the plugin enrolls the site in UpdraftCentral by default, and the keys do not expire.

The Updraft team has since shared the following guidance:

1. Remove the malicious plugin and check for any unfamiliar WordPress users.
2. Delete existing UpdraftCentral connection keys under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral → Manage existing keys.
3. Change WordPress administrator and TeamUpdraft account passwords.
4. Update UpdraftPlus to the latest version, then reconnect to UpdraftCentral with a new key.

TeamUpdraft is also preparing an emergency UpdraftPlus release that will automatically disconnect every UpdraftCentral connection made before 22:00 BST on October 18.

What Monarx is seeing

Across our hosting partner network, the Monarx Threat Research team is seeing fake plugins installed on WordPress sites through the UpdraftCentral command channel. Most of the installs originate from two IP addresses, one IPv4 and one IPv6.

Each fake plugin uses a two-word, harmless-sounding name followed by a random suffix, designed to blend in with legitimate site-maintenance and performance plugins. A site owner skimming their plugin list could easily mistake site-health-a1b2 or speed-press-c3d4 for something they installed themselves.

Once active, these plugins act as backdoors that give the attacker persistent access to the site. Public research shows the backdoor creates a hidden account that looks like an Editor but holds administrator-level capabilities, and logs in by setting a cookie directly, which bypasses two-factor authentication and login protection plugins.

Indicators of compromise

Source IP addresses

• 43.250.53[.]42
• 2a09[:]bac5[:]4e21[:]2e3c[::]49b[:]9

Attackers can rotate infrastructure at any time, so treat these IPs as a starting point for log review, not as a blocklist that keeps you safe.

Plugin folder name patterns (xxxx = random characters)

• site-health-xxxx
• site-tools-xxxx
• site-cache-xxxx
• site-guard-xxxx
• query-engine-xxxx
• block-binder-xxxx
• meta-suite-xxxx
• render-suite-xxxx
• flex-toolkit-xxxx
• list-board-xxxx
• view-helper-xxxx
• speed-press-xxxx
• script-board-xxxx
• view-shelf-xxxx
• page-kit-xxxx
• media-case-xxxx
• cache-bridge-xxxx
• speed-stock-xxxx

The names will change in future waves. If you find a plugin you don't recognize installed with no matching action from an administrator, treat the site as compromised.

How ThreatShield protects hosting partners

As soon as our Threat Research team identified the campaign, our Engineering team crafted and deployed new rules targeting these backdoor plugins. Every hosting partner running ThreatShield received that protection automatically, across their entire fleet.

This matters because the attack is unusually hard to stop with traditional tools. The malicious commands are correctly signed with genuine keys, so the plugin itself sees nothing wrong. Some hosts have responded by mass-removing UpdraftPlus from every customer site, because they found no reliable way to block the attack at the WAF or network level.

With ThreatShield, our partners don't have to make that trade-off:

• No plugin removal. Customers keep UpdraftPlus and their backups running while the vendor works on a fix.
• No custom mod_security, WAF or firewall rules. Hosts don't need to write, test and maintain emergency rules under pressure.
• No IP chasing. Protection doesn't depend on blocking the attacker's current addresses, which can change at any time.
• No action from site owners. Protection is applied at the server level, so it covers every site on the host, including sites whose owners don't know they hold an UpdraftCentral key.

Why run-time protection matters

This campaign shows the limit of defenses that only look at how malware gets in. Here the delivery path was a trusted, signed management channel, so perimeter tools had nothing suspicious to block. What stays the same is that the malicious code eventually has to run on the server.

That is where ThreatShield works. It watches code as it executes, so it can stop malware at the moment it tries to run, regardless of how the file arrived: a stolen key, a vulnerable plugin, compromised FTP credentials or a malicious upload.

For hosting partners, that means:

• Protection that doesn't wait for a patch. When a vendor has no fix yet, sites stay protected anyway.
• One response that covers every site. New rules from Monarx reach the whole fleet at once, without per-site work.
• Less disruption for customers. Legitimate plugins and workflows keep running while the threat is blocked.
• Fewer cleanups and support tickets. Stopping the backdoor before it executes means fewer compromised sites to restore later.

Recommended actions for website owners

If your host runs ThreatShield, you are already protected against this campaign. We still recommend the steps below as good hygiene.

For all WordPress site owners using UpdraftPlus:

1. Check whether your site holds an UpdraftCentral key, even if you've never used UpdraftCentral. With WP-CLI: wp option get updraft_central_localkeys. Any output means the site is exposed.
2. Delete every UpdraftCentral key from the site itself under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral → Manage existing keys. Removing the site from the UpdraftCentral dashboard is not enough.
3. Review your plugin list, including Must-Use plugins, for any name matching the patterns above or anything you don't recognize.
4. Review all users, not just administrators. The backdoor account can appear as an Editor while holding admin capabilities.
5. Change passwords for all WordPress administrators and your TeamUpdraft account, and log out all sessions.
6. If you find a backdoor, treat the site as fully compromised and consider restoring from a backup taken before October 17, 2026.
7. Follow TeamUpdraft's security notice for updates on their emergency release before reconnecting to UpdraftCentral.

‍

Hosting companies interested in run-time protection for their customers can contact Monarx to learn more about ThreatShield.

We will update this advisory as the investigation develops.