The UpdraftCentral campaign: when the attacker has valid keys

What happened

Security researchers at Patchstack report that over roughly 18 hours spanning October 18 to 19, 2026, an attacker used valid UpdraftCentral dashboard keys to push backdoor plugins onto connected WordPress sites. UpdraftCentral is the remote-management companion to UpdraftPlus, one of the most widely installed backup plugins in the WordPress world: it lets one dashboard manage many sites, authenticated by keys.

That is what makes this one different. The malicious commands were signed with genuine dashboard keys, so from each site's point of view, every check passed and the instruction looked legitimate. This was a key compromise, not a bug you patch: as of October 19, 2026 there was no fixing update, and Patchstack's advice was to delete UpdraftCentral keys and remove the plugin connection. We describe this as "researchers report" because it is currently a single-source account; it is also exactly the kind of account worth acting on cheaply, because the response costs minutes.

A rough year for WordPress plugins

This lands on top of a bruising 2026 for the WordPress plugin supply chain: the Essential Plugin portfolio backdoor in April, ARVE (CVE-2026-18072, scored 9.8) in July, and Uncanny Automator Pro (CVE-2026-12375), also in July. The pattern is consistent: the way into small-business sites is rarely WordPress itself, it is the plugins around it and the credentials that manage them.

What to do

• If you or anyone who ever managed your site used UpdraftCentral: log in to WordPress, go to the UpdraftPlus settings, and delete the UpdraftCentral keys. If you don't use it, remove the connection entirely.
• Review your installed plugins. Anything you don't recognize, deactivate and investigate before deleting (a copy helps diagnosis).
• If you find a plugin you didn't install, treat the site as compromised: restore from a backup made before October 18 and rotate every password connected to the site.
• Going forward: know who maintains your plugins. If the honest answer is nobody, that is the actual vulnerability.

The uncomfortable question

Most small-business owners we talk to can't say who maintains their website's plugins, because the site was built by someone years ago and has quietly run since. That is normal, and it is fixable. Our free check reads your site from the outside and will spot UpdraftPlus if it is visible; what it can't see is your plugin list, your keys, or your update status. A passive check only sees what your site shows the public. We verify from the inside.