TeamUpdraft, the company behind UpdraftPlus, has disclosed unauthorised access to teamupdraft.com over the weekend of 17–18 October 2026. Starting on 18 October, UpdraftCentral connection keys were used to install backdoor plugins on connected WordPress sites.
What happened
TeamUpdraft says it believes its customer database was accessed. Along with names, emails, billing details and hashed passwords, that database held the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.
UpdraftCentral is TeamUpdraft’s remote-management service. A site that holds a key accepts commands signed with that key, including commands to install and activate plugins. Because the commands were signed with genuine keys, the sites treated them as legitimate. Patchstack describes it as a key compromise rather than a flaw in the plugin’s code.
Patchstack, drawing on analysis by Nethemba, reports 99 different backdoor plugin names. The plugin waits for a secret link and, when the link is visited, creates a hidden account with administrator-level access. That account stays even if the plugin is removed. Some versions of the plugin cause a “critical error” on the site, which is how a number of owners noticed.
TeamUpdraft released UpdraftPlus 1.26.12 on 19 October to revoke keys created before the incident, followed the same day by 1.26.13, which the changelog describes as “properly apply the revocation”. Wordfence has released an emergency firewall rule to its free users that blocks inbound UpdraftCentral commands.
Who is exposed
Sites that hold an UpdraftCentral key from the cloud service at teamupdraft.com are exposed.
That is not the same as every site running UpdraftPlus. Wordfence notes that a site without a connection key does not accept UpdraftCentral commands. Self-hosted UpdraftCentral is not affected, according to TeamUpdraft.
Two details catch people out. Keys do not expire, so a site connected years ago still counts. And according to Patchstack, connecting a teamupdraft.com account inside the plugin creates a key by default, so a site can hold one even if nobody set out to use UpdraftCentral.
Updating plugins is not enough here
Sites running the latest version of UpdraftPlus were affected. Patchstack noted on 19 October that no plugin update stopped the attack, because the commands arrived signed with valid keys.
The revocation release stops old keys working from now on. It does not remove a plugin or account that was planted before it was installed, which is why TeamUpdraft’s own instructions still include checking for unknown users and plugins after updating. Wordfence says the same of its firewall rule: it “cannot undo a compromise that occurred before the rule was deployed.”
Regular updates fix flaws in a plugin’s code. This attack came through a trusted connection rather than a flaw, so the check has to be done on each site.
What our clients need to do
Nothing.
Fortunately, UpdraftCentral is not usually part of our backup setup. For the clients whose sites were connected to the service, we have removed the connection keys and given each site a clean sweep for unknown plugins and accounts. UpdraftPlus backups carry on as normal; they do not depend on the key.
Self-managed sites
If your site uses UpdraftPlus:
- Log in to the site’s own WordPress dashboard, not through UpdraftCentral.
- Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later.
- Go to Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral and delete any connection keys. Removing the site from the UpdraftCentral dashboard leaves the key on the site, so do this on the site itself.
- Check Users for administrators or editors you don’t recognise, and Plugins (including Must-Use) for anything you didn’t install. Patchstack’s most reliable indicator is a plugin described as “Small maintenance toolkit: keeps option storage tidy.”
- If you find one, don’t try to fix a plugin that is causing an error; Patchstack notes that fixing it switches the backdoor on. Deactivate it and move it off the server, then remove the account it created.
- Change all administrator passwords and your teamupdraft.com password.
If anything suspicious turns up, TeamUpdraft advises restoring from a backup taken before 17 October.
Patchstack’s full write-up lists all 99 plugin names and the search commands. TeamUpdraft’s incident page is being updated as the investigation continues.
If you would like someone to check your site, get in touch or see our managed WordPress care plans.
