Note: Similar to CVE-2026-10795, but I was on 1.26.8, I did not restore a backup or take any action for this to occur, to my knowledge.

TEAM UPDRAFT CONFIRM BREACH TO UPDRAFT-CENTRAL:
Looks like I was lucky to spot it as it happened, killed it, then posted here. Hopefully some of you caught it.

"On October 18, we identified unauthorized access to TeamUpdraft, which we believe may have exposed UpdraftCentral connection keys. Our team has since closed the access route.

Based on our development team’s recommendations, please take the following precautions:

1. Remove the malicious plugin and check for any unfamiliar WordPress users.
2. Delete your existing UpdraftCentral connection keys under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral → Manage existing keys.
3. Change your WordPress administrator and TeamUpdraft account passwords.
4. Update UpdraftPlus to the latest version, then reconnect to UpdraftCentral using a new c"

-----------

My original post:

This morning my site started throwing fatal errors on every page. The cause was a plugin I never installed, called “Image Core” (folder wp-content/plugins/image-core/, author “StoneDock Tools”, version “3.1.1”, described as a “small maintenance toolkit”).

What the plugin does: it hooks init. If a request has ?_6212fc=_BEQI71sdL1mVAkslzjLMnG8ffyJfBwi, it creates a user called render_maint13 (email [render_[email protected]](mailto:[email protected]), display name “Site Tools”). That user gets the Editor role plus the manage_options and install_plugins capabilities. It then logs the visitor in as that user and redirects to wp-admin.

On my site it never got that far. The attacker referenced self::FIELD but had defined the values as global constants, so it died with Undefined constant ImageCore::FIELD before it could create the user. A working version would have been silent.

How it got in: the access logs show no wp-admin login, no plugin upload and no file editor use. Instead there were two POSTs to / with this user agent:

class-udrpc.php is UpdraftPlus’s remote-control library (UpdraftCentral).

Source IP for both: 2a09:bac5:4e21:2e3c::49b:9 (a Cloudflare WARP address, so not the attacker’s real IP).

UpdraftPlus was 1.26.8. An UpdraftCentral key had been created on my site, maybe that leaked somehow, or could be a bug.

Check your site:

Search your access logs for class-udrpc.php in the user agent, or _6212fc in URLs.

Look for wp-content/plugins/image-core/ and a user called render_maint13.

If you run UpdraftPlus: go to Settings → UpdraftPlus → UpdraftCentral, delete any keys you don’t use, and update. Or remove it. Reset your UpdraftPlus login password.

If you were hit: delete the plugin and the user, then rotate your passwords, salts, Application Passwords and API keys.