A backup plugin can be up to date and still leave a door open. Over the weekend of 17-18 October 2026, someone gained unauthorised access to teamupdraft.com, the company behind UpdraftPlus. The immediate worry for WordPress owners isn’t a bad plugin download. It’s stolen UpdraftCentral connection keys, which have been used to put backdoors on sites.
Update, 22 Oct: TeamUpdraft now confirms the attacker created admin accounts, and asks Premium users to check for new admins and unknown plugins even if they never used UpdraftCentral. Here is what we found on our maintenance clients’ sites.
If you read our 16 October post about updating UpdraftPlus before restoring a backup, this is a different problem. That advice dealt with a plugin bug. Here, an attacker got keys from the vendor and sent commands that looked authorised. Nobody knows how many sites were hit.
What happened at TeamUpdraft?
TeamUpdraft believes its customer database was accessed. That includes names, email and billing addresses, order history, hashed passwords, two-factor settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It says card details weren’t involved because payments go through Stripe or PayPal. The company reported the incident to the UK ICO.
TeamUpdraft also says the UpdraftPlus plugin and its downloads weren’t affected. Self-hosted UpdraftCentral wasn’t affected either. That’s reassuring, but it doesn’t make a site with a stolen cloud connection key harmless.
UpdraftCentral is TeamUpdraft’s remote dashboard. Its client is built into every UpdraftPlus installation - more than four million active installs - but a site only accepts its commands after it has an UpdraftCentral key. A validly signed command runs with the rights of the administrator who connected the site. It doesn’t ask that administrator to approve each action.
Why a firewall might not catch this
The attacker sent a signed plugin.upload_plugin command. WordPress installed and activated a backdoor plugin as though the remote dashboard had legitimately asked it to. This wasn’t an UpdraftPlus code bug, and a firewall looking for suspicious requests won’t necessarily reject a valid command. Nethemba, the Slovak security firm that found the attack on its own sites, described an affected administrator using Wordfence, Patchstack and Cloudflare.
One backdoor lets a visitor with a secret, 32-character URL token create an account, get a login cookie and land in wp-admin. No login form means no login limit or two-factor prompt. The account appears as an Editor, not an Administrator, yet has extra powers to install plugins and change settings. It stays after the backdoor plugin is removed. Another variant creates an administrator and tries to hide it.
Patchstack saw 99 different backdoor plugin names installed between 18 October at 15:32 and 19 October at 09:23 UTC. Site Health Cache is a recurring name; others are plausible-sounding combinations of two or three words. Don’t judge a plugin by how ordinary its name looks.
Do you have UpdraftCentral keys without knowing it?
Quite possibly. When you connect UpdraftPlus to a teamupdraft.com account, for example to activate a Premium licence and updates, Add this website to UpdraftCentral is ticked by default. Leave it ticked and the site gets a key. Site-side keys don’t expire; keys created in November 2025 still worked in October 2026.
Check each WordPress site with UpdraftPlus, even if you’ve never opened the remote dashboard:
- Did someone connect the site to a teamupdraft.com account? Treat it as potentially connected until you’ve checked the keys.
- In the site’s own admin area, open
Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral > Manage existing keys. Any key there means the site can accept signed dashboard commands. - If you use WP-CLI, run
wp option get updraft_central_localkeys. Any output means there’s a connection to investigate. A site with no key doesn’t accept these commands.
Update to 1.26.13, not 1.26.12
On 19 October, TeamUpdraft released UpdraftPlus 1.26.12 and Premium 2.26.12 to revoke old UpdraftCentral Cloud keys. Nethemba checked the code and found a bug: the update deleted none of them. Later that evening, TeamUpdraft released 1.26.13 and Premium 2.26.13 to properly apply the revocation. At the time, TeamUpdraft’s own notice still said 1.26.12 was enough. It wasn’t.
Even 1.26.13 only removes keys created before 12:07 UTC on 18 October. Keys created from 12:07 to 21:00 UTC that day - 15:07 to midnight in Tallinn - remain. My take: don’t try to work out when each key was made. Delete every one by hand.
What to do on each site
Work through the sites you own or manage, not just the busiest one. If someone else handles updates, send them this list and ask them to confirm what they found.
- Log in through that site’s own
wp-admin, not UpdraftCentral. Update UpdraftPlus to1.26.13, Premium to2.26.13, or a newer version. - Go to
Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral > Manage existing keysand delete every key. With WP-CLI, usewp option delete updraft_central_localkeys. Remove the site from the UpdraftCentral dashboard too, but don’t stop there: the key on the site is what matters. Don’t reconnect untill TeamUpdraft explains more. - Check
Plugins, including theMust-Usetab, and inspect the plugins folder on the server. One variant hides from the plugin list. Look forSite Health Cacheand anything you don’t recognise. - Check
Usersacross all roles, especially Editors, not just Administrators. Delete unknown accounts. - Change every admin password, your teamupdraft.com password and any password reused elsewhere. Reset two-factor authentication on your TeamUpdraft account and reconnect UpdraftVault if you use it. If the site was accessed, re-authorise remote storage such as Google Drive, Dropbox or S3 and change its storage keys.
You don’t need to uninstall UpdraftPlus. Backups still work after the keys are deleted; remote management stops. At least one UK host, Mythic Beasts, disabled UpdraftPlus across its managed WordPress sites, but removing your site-side keys is the more useful step for a small business that still needs backups.
If you find a backdoor or an unknown user
Don’t just delete the odd plugin and call it done. An account created by the backdoor can remain after that plugin is gone. Restore from a backup taken before 17 October or have the site cleaned, then update UpdraftPlus and remove the restored keys before treating it as ready. Our step-by-step guide to a hacked WordPress site covers the wider cleanup. If you need someone to inspect the files and accounts, that’s what our site cleaning service is for.
If customer data may have leaked, assess whether the GDPR 72-hour breach reporting clock applies to your business. Don’t wait for a confirmed victim count; nobody has one. And if you’re juggling several sites, ongoing WordPress maintenance can take the update and checking routine off your plate. For today, start with the site-side keys on your own site’s UpdraftCentral screen.