UpdraftPlus Users: Check Your WordPress Sites for UpdraftCentral Keys After the TeamUpdraft Breach

أكتوبر 19, 2026

0

If you run WordPress, there is a good chance UpdraftPlus is handling your backups. It is the most popular WordPress backup plugin, with more than 4 million active installations. This week its developer, TeamUpdraft, confirmed a security incident that attackers are already using to plant backdoors on real websites. Here is what happened and what you should check today.

What happened

TeamUpdraft says it found unauthorised access to the teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed. That database holds names, email addresses, billing addresses, order history, hashed account passwords, two-factor authentication settings, and the connection keys for its UpdraftCentral, UpdraftVault and UpdraftClone services. TeamUpdraft says it does not store card details, and that the UpdraftPlus plugin and its downloads were not affected.

The keys are the real problem. UpdraftCentral is a remote management service, and its client is built into every copy of UpdraftPlus, free and premium. A site that has an UpdraftCentral key will carry out any command signed with the matching dashboard key, and nobody has to approve it.

How attackers are using the stolen keys

Security firm Nethemba spotted the attack on its own sites. Patchstack then confirmed it and expanded on the findings. Using valid keys, the attacker sent commands that told connected sites to install and activate a plugin. Each of those plugins was a backdoor. Patchstack recorded installations from October 18 into October 19 and counted 99 different backdoor plugin names.

Because the commands were properly signed, the site saw them as legitimate. Nethemba reports that one affected site was running Wordfence, Patchstack and Cloudflare, and none of them stopped the command. Some variants create a hidden or disguised admin account, and one hides itself from the plugin list.

Am I affected?

Sites that are connected to UpdraftCentral, meaning they hold an UpdraftCentral key, are the ones at risk. Free UpdraftPlus users who have never had a teamupdraft.com account do not need to take action, according to TeamUpdraft. Even so, do not assume you are safe just because you never set up UpdraftCentral. Both Patchstack and Nethemba found that the checkbox to add a site to UpdraftCentral is ticked by default when you connect a teamupdraft.com account, which is common when activating Premium. Self-hosted UpdraftCentral is not affected, according to the vendor.

What to do now

Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. Nethemba found that the first emergency release, 1.26.12 / 2.26.12, failed to delete any keys because of a bug. The vendor fixed this in 1.26.13 / 2.26.13 the same evening.
Delete the UpdraftCentral keys by hand anyway. Go to Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, then Manage existing keys, and delete every key. Removing the site from the UpdraftCentral dashboard is not enough, because the key that matters is stored on the site.
Check your users. Look for accounts you don't recognise, including Editor accounts, since Patchstack found the backdoor account can look like an Editor while holding admin-level permissions.
Check your plugins, including the Must-Use tab. Remove anything you didn't install. Because some variants hide from the plugin list, consider running Nethemba's read-only checking script or asking your host to scan the site files.
Change all administrator passwords and your teamupdraft.com password. Type teamupdraft.com into your browser instead of clicking email links, and change the same password anywhere else you used it.
If you find signs of a compromise, restore from a clean backup taken before October 17 and treat the site as fully compromised.
UpdraftVault users need to reconnect each site with their new credentials, since TeamUpdraft disconnected every site from Vault.

The bigger lesson

Sites in this attack could be fully up to date and running a firewall, and still get hit. The weak point was a third-party service with standing access to the site. It is worth reviewing which remote management tools, dashboards and agencies hold keys to your WordPress installs, and removing any you no longer use. Good hosting backups stored separately from your plugins give you one more way to recover when something like this happens.