Attackers Abuse UpdraftCentral Connection Keys to Silently Backdoor WordPress Sites (CVE-2026-111862)

Scope: WordPress sites running UpdraftPlus Free or Premium with an active UpdraftCentral connection key

Severity: Red

UpdraftPlus is one of the most widely installed WordPress backup plugins, and attackers have been abusing a flaw tracked as CVE-2026-111862 (CVSS 9.8) in TeamUpdraft’s cloud-hosted UpdraftCentral service, which site owners use to manage multiple WordPress installations remotely. If an attacker-controlled request matches a valid connection token, it silently creates a new WordPress user named “data-ops43” with the display name “Site Tools,” assigns it the Editor role, and grants it manage_options and install_plugins capabilities, giving the attacker the ability to upload arbitrary PHP plugins and change core site settings without the legitimate administrator noticing anything unusual at first glance. TeamUpdraft has responded by disconnecting every site from UpdraftVault and issuing new credentials across the board, and is urging any site that was accessed through UpdraftCentral to re-authorise remote storage and rotate storage access keys as a precaution, even beyond the initial credential reset. Given how widely UpdraftPlus is deployed across Ugandan business and institutional WordPress sites for backup management, this is worth checking regardless of whether an organisation remembers actively using UpdraftCentral recently. Administrators must check their WordPress user list for an account named “data-ops43” or displaying as “Site Tools” and remove it immediately if found, and should rotate UpdraftCentral connection keys and any remote storage credentials as a precaution even if no sign of compromise is visible.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.