UpdraftCentral breach

UpdraftPlus

Attackers breach TeamUpdraft's website, gain access to customer connection keys

Do this now

Upgrade UpdraftPlus to 1.26.13 and UpdraftPlus Premium to 2.26.13, then rotate customer connection keys.

Fix it

UpdraftPlus

Upgrade to UpdraftPlus 1.26.13

UpdraftPlus Premium

Upgrade to UpdraftPlus Premium 2.26.13

First seen: 21 Oct 2026
Last update: 26 Oct 2026, 11:34 UTC
Fixed in: UpdraftPlus 1.26.13
UpdraftPlus Premium 2.26.13
Source: news
On the menu as: WordPress

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## UpdraftCentral breach
Severity: unknown. Patch status: patched.
Affected: UpdraftPlus
Fixed in: UpdraftPlus 1.26.13, UpdraftPlus Premium 2.26.13

Attackers breach TeamUpdraft's website, gain access to customer connection keys

## Steps
1. Search the repo, its CI and infra config for UpdraftPlus. If present, report the version in use and whether it's affected.
2. Fix by release line: UpdraftPlus: 1.26.13. UpdraftPlus Premium: 2.26.13.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| UpdraftPlus | fixed | 1.26.13 | — |
| UpdraftPlus Premium | fixed | 2.26.13 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://thehackernews.com/2026/10/attackers-abuse-updraftcentral-keys-to.html https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/
https://pwned.coffee/i/updraftcentral-breach

Timeline

26 Oct 2026, 11:34 UTC
Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium), then look for rogue plugins and admin accounts. Updating does not clean a site that was already backdoored.
26 Oct 2026, 11:34 UTC
Fix status: unknown → patched.
21 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
UpdraftPlus before 1.26.13 1.26.13 Reported
UpdraftPlus Premium before 2.26.13 2.26.13 Reported
Score: No CVSS published yet: severity unknown.
Last checked: 26 Oct 2026, 13:17 UTC

Product	Affected	Fixed in	Source
UpdraftPlus	before 1.26.13	1.26.13	Reported
UpdraftPlus Premium	before 2.26.13	2.26.13	Reported

Sources: KEV – CVE record – Vendor –

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone coffee