Attackers abuse stolen UpdraftCentral keys from TeamUpdraft breach to install malicious plugins on WordPress sites
Attackers used UpdraftCentral connection keys exposed in an October 17-18, 2026 breach of the TeamUpdraft website to send validly signed remote-management commands to WordPress sites running UpdraftPlus. The commands installed malicious plugins that give unauthorized access, and Wordfence also saw attempts to delete existing plugins. Team…