A security breach affecting UpdraftPlus, a WordPress backup plugin installed on over 3 million websites, enabled attackers to install malicious plugins and create unauthorized administrator accounts. The attack exploited compromised UpdraftCentral connection keys, allowing attackers to take control of connected WordPress websites without needing a username or password.

Updraft Website Compromised

TeamUpdraft confirmed that its website was compromised over the weekend of October 17-18, 2026. The company believes attackers accessed its customer database, which contained customer information and connection keys for services including UpdraftCentral.…