Most WordPress sites now hand a copy of their keys to someone else: a backup service, a management dashboard, an AI connector. Each one is convenient. Together they form the next big target, because breaking into one company can open thousands of sites at once. It isn’t a theory anymore: it happened this week.
In 30 seconds
- Some services keep a key to your site on their servers. If they get hacked, the attacker gets that key, for every site at once.
- It just happened to UpdraftCentral (October 2026): stolen connection keys, backdoors installed on connected sites.
- AI makes these attacks faster, for attackers and defenders alike.
- Don’t leave any of them connected. Use a service for the job, then revoke its access. There is always another way. Here’s how.
It already happened, this week
UpdraftPlus is one of the most popular backup plugins, on more than 3 million sites. Its company also runs UpdraftCentral, a dashboard to manage many sites from one place. On 19 October 2026, TeamUpdraft announced that its customer database had been accessed, including hashed passwords, two-factor settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The attacker used those keys to create admin accounts and install malicious plugins on connected sites. TeamUpdraft says the extent “is unknown”.
Patchstack, which tracked the campaign, counted 99 different backdoor plugin names installed in about 18 hours, on 18 and 19 October. The fixed versions (UpdraftPlus 1.26.13 and 2.26.13) disconnect every UpdraftCentral connection. TeamUpdraft even believes the attackers used AI to move that fast.
Using UpdraftCentral? Update UpdraftPlus, check your users for admin or editor accounts you don’t know (names like data-ops43 or media-staff96), look for plugins you didn’t install (even if you already disconnected: on some sites that were hit, TeamUpdraft found hidden plugins that kept creating admin accounts afterwards), and change your passwords. If you find a backdoor, treat the site as fully compromised and restore a clean backup. Details in Patchstack’s write-up.
Why this is the next big WordPress hack
Hacking one website is slow. Hacking the company that holds the keys to 100,000 websites is one attack. Outside WordPress, this is exactly how two of the worst attacks in recent years worked: SolarWinds (a poisoned update reached about 18,000 organisations) and Kaseya (one remote management tool, up to 1,500 businesses hit by ransomware).
WordPress has had its own versions: the AccessPress vendor site was breached in 2021 and 93 of its themes and plugins shipped with a backdoor, and in 2024 five WordPress.org plugins were backdoored through their developers’ reused passwords.
And it is getting faster. PHP2Shell, the PHP flaw of last week, was found with AI tools. Patchstack’s 2026 report puts the median time from disclosure to first exploit at 5 hours. Any service holding thousands of keys is now a much more attractive target than any single site.
Who holds keys to your site
These are the biggest services that can act on many WordPress sites from the outside. Most are well run and patched problems fast. The question isn’t whether they are good companies: it’s what happens if one of them is breached, sold, or changes its rules. The key point is the last column: whether the keys live on their servers or on yours.
My advice
- Don’t keep any of these connected. Your host is the only one you can’t avoid, which is why choosing it well matters so much.
- Need one for a job? Use it temporarily. Connect it, do the job, then revoke its access (its key, its application password, its connected app), so it no longer holds anything that opens your site.
- There is always another way. Backups saved to your own storage, updates from your own dashboard, a manager you host yourself (the “your own” rows above), AI tools connected directly to your site.
The AI connectors are the newest keys
Connecting ChatGPT or Claude to WordPress is the new must-have, and it means giving an AI, and whoever sits in between, real power over your site. WPVibe is the most visible option. It is made by Awesome Motive, the company behind WPBeginner, which is why you see it recommended so often. When you connect, WordPress creates an application password for your user, and it is stored, encrypted, “on Cloudflare-hosted WPVibe servers”. Every request goes through them. Its free plan stops at 100 actions a day, then it is from $99 a year. Here is how it compares with AI Engine.
An application password for an administrator carries everything that administrator can do, across every connected site. If that store is ever breached, the UpdraftCentral story repeats, only with an AI-shaped key.
Full disclosure: our own keys
It would be too easy to point at others, so here is exactly where we stand.
AI Engine, connected directly. When you connect Claude or ChatGPT straight to your site with AI Engine, there is nobody in between. Nothing is stored on our side, and we have no way to act on your site.
Our ChatGPT and Claude connector (for people without AI Engine set up yet) is a relay, like WPVibe. It runs on Cloudflare, it is free with no daily cap, it never stores your WordPress password, and the content of your requests is never logged or stored. What it does keep: the access keys of each connection, encrypted, which expire 30 days after their last use, and a usage record per request (site, tool, success, duration). Its weak point, and it’s the same for every relay: if someone stole our ability to deploy code, modified code could capture the keys of the connections used while it runs. Our Cloudflare account has a single member with two-factor login, and deploys only happen from one machine.
Our Pro plugins download their updates from meowapps.com, like every premium plugin downloads from its vendor (and free plugins from WordPress.org). That update channel is a key too: it’s exactly how the AccessPress attack worked. That’s true of every plugin you install, ours included, and the reason to keep the list of plugins you trust short.
Take back control in 10 minutes
Using AI Engine with our connector? The same rule applies to us: when you’re done, revoke it in AI Engine → MCP → Connections → Manage. That revokes the site’s keys immediately, whatever happens anywhere else. Better still, connect your AI assistant directly to AI Engine, with nobody in between.
You can still use these tools when you need them. Just don’t leave them connected: give a key for the job, take it back after, and keep the list of who can open your site as close to empty as you can. Questions? Come talk about it on our Discord. 😺
