I run a WordPress site that uses UpdraftPlus. On 19 Oct I found an unknown plugin had been uploaded and a hidden admin user was attempted on my site. I traced it, reported it to Team Updraft, and they confirmed to me (via support ticket) that their own site was breached on 18 Oct and they believe UpdraftCentral connection keys were compromised too. As far as I can tell this isn’t publicly announced yet, so I’m posting because anyone using UpdraftCentral should act today.

What matters most: this is not a plugin vulnerability you can fix by updating. My site was running a fully patched UpdraftPlus (well past the CVE-2026-10795 fix). The attacker didn’t bypass the patch — they used a genuine, stolen UpdraftCentral key to send a signed command to my site. Updating the plugin alone does not protect you. You have to remove the connection key.

What happened on my site (timeline, UTC):

• The attacker sent one command via the UpdraftCentral RPC channel: plugin.upload_plugin.
• It dropped a fake plugin (“Feed Stack 90E”, author “CommonGantry”) — a backdoor that, when visited with a secret URL parameter, creates a hidden admin user, logs the attacker in, and redirects to wp-admin.
• In my case it failed by pure luck: the attacker’s own code had a bug (referenced class constants that were actually defined globally), so it fatal-errored before creating the user. Had their code been correct, it would have worked on a fully hardened, patched site. Don’t count on being this lucky.
• The only trace left was a DB option feed_stack_90e_sync_token, written by the plugin’s activation hook.

What Updraft told me (paraphrased from their ticket): they detected unauthorised access to teamupdraft.com on 18 Oct, closed the route, signed everyone out, and reset affected keys. They believe their customer database was accessed (names, emails, order history; passwords are hashed, no payment data stored). They’re asking every UpdraftCentral customer to disconnect and check each connected site now, even if it looks fine.

What YOU should do right now (from their guidance + my experience):

1. Log into each site’s own WordPress dashboard (not through UpdraftCentral).
2. Settings → UpdraftPlus → Advanced Tools → UpdraftCentral → delete the connection key.
3. Check Users and Plugins for anything you don’t recognise and remove it. Important: a competent backdoor hides the admin user from the Users screen — so also check directly in the database if you can: SELECT u.ID,u.user_login,u.user_email FROM wp_users u JOIN wp_usermeta m ON m.user_id=u.ID WHERE m.meta_key='wp_capabilities' AND m.meta_value LIKE '%administrator%'; Compare that to what wp-admin shows. Also check for the option feed_stack_90e_sync_token or any plugin/user you didn’t create.
4. Change your WordPress admin passwords.
5. Update UpdraftPlus to the latest version.
6. Change your teamupdraft.com password — type the address manually, don’t click email links — and change it anywhere else you reused it. Reset 2FA there if you use it.
7. If you use UpdraftVault, they’ve disconnected it as a precaution; reconnect to resume backups.

IOCs from my case, so you can grep your logs/DB:

• Dropped plugin slug: feed-stack-90e / name “Feed Stack 90E” / author “CommonGantry”
• Attempted hidden user: media.team14 (editor + manage_options + install_plugins)
• Backdoor trigger GET param: _0dff5c
• DB option written: feed_stack_90e_sync_token
• UpdraftCentral RPC command used: plugin.upload_plugin

The attack came in over the normal UpdraftCentral channel, so your login protection (2FA, Cloudflare Access, etc.) does not stop it — it isn’t a login. The only thing that closes it is removing the key.

I’m posting this because many people might be affected, just like I was. Our website was compromised, but thankfully – no damage was done due to hacker's own incompetence.

Full source of the dropped plugin (credentials redacted): https://paste.ofcode.org/WhBgBZtkHjDYQiQmNkTpMb