UpdraftPlus breach: stolen UpdraftCentral keys planted backdoors on WordPress sites

TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin, says its own website was accessed without authorisation over the weekend of 17-18 October 2026, and that stolen UpdraftCentral connection keys were then used to install backdoor plugins and create hidden accounts on connected WordPress sites. Updates 1.26.13 (free) and 2.26.13 (Premium), released on 19 October, revoke the old keys, but they do not remove anything an attacker already planted. If you run UpdraftPlus, update it, delete any old UpdraftCentral key, and check each site for unknown users and plugins.

What TeamUpdraft says happened

In its security incident page on teamupdraft.com, first posted on 19 October 2026 by Joe Whittaker and last updated on 23 October 2026 at 05:26 BST, TeamUpdraft says it identified unauthorised access to the teamupdraft.com website over 17-18 October. The company says it believes its customer database was accessed. According to TeamUpdraft, that database holds names, email addresses, billing addresses and order history; account passwords, stored only in hashed form; two-factor authentication settings; and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.

TeamUpdraft says it does not store card details, because card payments are handled by Stripe and PayPal. It also says the UpdraftPlus plugin itself and its downloads were not affected, and that backups sent to a site owner's own remote storage, such as Google Drive, Dropbox or Amazon S3, were not affected. There is one caveat on that last point: if a site was accessed through UpdraftCentral, TeamUpdraft asks owners to re-authorise their remote storage and change any storage access keys as a precaution. TeamUpdraft states that self-hosted UpdraftCentral is not affected.

In its 21 October update, TeamUpdraft said the attacker used a compromised key to access its site, that there is currently no evidence the attacker still has access, and that the attacker exploited the connection to users' sites to create admin accounts and install malicious plugins. TeamUpdraft said the full extent of that is unknown. The same update says TeamUpdraft brought in an external cyber security firm, contacted the relevant authorities including the police, and believes the speed of the exploits and the initially faulty backdoor plugins suggest the attackers used AI to accelerate the attack. The original post also says the incident was reported to the UK Information Commissioner's Office (ICO).

How the stolen keys reached WordPress sites

UpdraftCentral is TeamUpdraft's remote management service for running many WordPress sites from one dashboard, and its client ships inside UpdraftPlus. Patchstack, a WordPress security company, published a technical analysis on 19 October 2026 written by its security research lead Dave Jong. Patchstack credits Nethemba, which caught the attack on its own sites and published the first analysis on 19 October, as the primary source for its description of the backdoor. Patchstack explains that once a site is given an UpdraftCentral key, it will execute any command signed with the dashboard's private key, with the permissions of the user who created the connection, and nobody confirms individual commands.

Patchstack's analysis says the attacker sent correctly signed commands to install a plugin, and WordPress installed and activated it through its standard installer. Patchstack summarised it on 19 October as "not a vulnerability in UpdraftPlus": the commands passed every check in the plugin because, from the site's point of view, they were legitimate. Search Engine Journal, in a 21 October report by Roger Montti, quoted the same passage and noted it was written before TeamUpdraft released its updates. That timing matters. Patchstack's line that "no plugin update stops it" described the situation on 19 October; TeamUpdraft's 1.26.13 and 2.26.13 releases later that day revoke the old keys, so that statement no longer describes the current state.

What the backdoor does, according to Patchstack

Patchstack says each delivered plugin is a backdoor that watches for a secret URL parameter. When it receives the right token, it creates an account, gives it the Editor role, and then separately grants that account the manage_options and install_plugins capabilities. It logs the visitor in by setting a cookie directly, so the normal login form never runs. Patchstack points out that this means two-factor authentication, login attempt limits and login protection plugins do not stop it.

Two further details from Patchstack explain why the attack is easy to miss. First, the account shows as an Editor, so a quick look at the administrator list will not find it. Second, the account stays in WordPress after the plugin is removed. Patchstack also reports that the samples it analysed contained a coding error that caused HTTP 500 errors on uncached requests, which is how some site owners noticed quickly. Patchstack warns against repairing such a plugin, because fixing the error would switch the backdoor on.

Patchstack says it observed 99 distinct backdoor plugin names in its telemetry, with "Site Health Cache" reused most often, and that every sample carried the same plugin description: "Small maintenance toolkit: keeps option storage tidy." Patchstack recorded backdoor installations between 18 October at 15:32 and 19 October at 09:23. TeamUpdraft's own 22 October update says it is seeing a pattern of unexpected "editor" roles, which matches Patchstack's description of how the hidden accounts appear.

Sites can be connected without the owner knowing

The detail with the widest reach is in Patchstack's analysis. Patchstack says connecting a site to a TeamUpdraft.com account shows a checkbox reading "Add this website to UpdraftCentral", and that the box is ticked by default. If the owner leaves it ticked, a successful login creates an UpdraftCentral key. Patchstack says this means sites that only ever used UpdraftPlus for backups can hold an active key. Patchstack also says keys do not expire, and that keys issued in November 2025 still worked in October 2026.

TeamUpdraft's own updates point the same way. On 21 October it asked UpdraftPlus Premium users to check their sites for signs of unusual activity "even if you've never used UpdraftCentral". On 22 October it asked users to log into UpdraftCentral through My Account and look at the sites listed there, and to check any site they did not knowingly connect since 19 October.

Timeline of the incident

The table below sets out the dated events as TeamUpdraft and Patchstack reported them. Times are as each source gave them.

TeamUpdraft's original post adds a specific cut-off: the new releases automatically disconnect every UpdraftCentral connection made before 13:07 BST on 18 October. Search Engine Journal reported that the plugin changelog describes 1.26.13 as correcting how the revocation was applied in the preceding release. On 20 October, TeamUpdraft responded to reports elsewhere of an ongoing attack, saying the unauthorised access was resolved and that the 19 October update blocked access across the UpdraftCentral route.

Who is affected and who is not

Based on what the sources state, the exposure depends on how a site was connected, not simply on whether UpdraftPlus is installed:

• Sites connected to UpdraftCentral cloud are the group TeamUpdraft tells to act "today". Patchstack says both free and Premium versions of the plugin were affected where an active key existed.
• Premium users who never used UpdraftCentral were still asked by TeamUpdraft on 21 October to check for unusual activity, which fits Patchstack's finding about the default-ticked checkbox.
• Anyone with a teamupdraft.com account should change that password, because TeamUpdraft believes hashed passwords and 2FA settings were in the accessed database.
• Self-hosted UpdraftCentral is not affected, according to TeamUpdraft.
• Free UpdraftPlus users without a teamupdraft.com account need to take no action, TeamUpdraft says, beyond keeping the plugin updated.

Patchstack also gave the plugin a broader context: it says UpdraftPlus has over four million active installations, while Search Engine Journal put the figure at over 3 million. TeamUpdraft itself announced on 2 October 2026 that UpdraftPlus had reached 4 million active installations. Neither source gave a count of compromised sites, and TeamUpdraft says the extent is unknown. Any figure for the number of hacked sites would be a guess.

What site owners should check now

TeamUpdraft's page sets out steps per product. For UpdraftCentral cloud users, it asks owners to secure each site directly, logging in to the site's own WordPress dashboard rather than going through UpdraftCentral:

1. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later, including sites you do not manage day to day.
2. Delete the old connection key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral.
3. Check Users for administrator accounts you do not recognise, and remove them. Given the "editor" pattern TeamUpdraft and Patchstack both describe, check Editor accounts too.
4. Check Plugins, including the Must-Use tab, and remove anything you do not recognise.
5. Change the passwords for all administrator accounts.
6. If you find anything suspicious, consider restoring from a backup taken before 17 October.

TeamUpdraft's 22 October update adds a review of server logs for IP addresses you do not recognise. UpdraftVault users need to reconnect each site, because all sites were disconnected from Vault, and then run a manual backup to confirm it works. UpdraftClone users who shared client keys with their own clients need to send the new keys from My Account, since old keys no longer work.

Where Patchstack's advice goes further

Patchstack's guidance is stricter on a few points, and site owners should know where the two sources differ. Patchstack says removing a site from the UpdraftCentral dashboard is not enough, because the key that matters is stored on the site itself. It says backups keep working after the key is deleted; only remote management stops. If a backdoor is found, Patchstack advises deleting the UpdraftCentral key first, then deactivating the plugin and moving it out of the web root instead of deleting it through wp-admin, because its uninstall routine erases its own traces. It also says to remove a database option ending in _sync_token and the backdoor account.

On reconnecting, the sources disagree. TeamUpdraft's step list ends with "Reconnect the site to UpdraftCentral." Patchstack's 19 October analysis says not to reconnect until the vendor explains the cause, and suggests that anyone who needs remote management create the key under an account without the install_plugins capability. Patchstack says that single detail stopped the attack on one publicly analysed site. TeamUpdraft's page, as of its 23 October update, has not published a full root-cause explanation, so owners who want the cautious route can wait.

General security practice, not from the sources

The following is standard WordPress hygiene rather than advice from TeamUpdraft or Patchstack. Keep an offline copy of a clean backup before restoring anything. Ask your hosting provider whether it keeps file-change or access logs for the 17-19 October window. And if you manage many client sites from one dashboard of any kind, list every connected site and confirm each one is still meant to be there.

Why a backdoored site is also an SEO problem

None of the three sources reported ranking losses or search warnings tied to this campaign, so there is no evidence of SEO damage yet. As general, well-documented practice, though, attackers who gain plugin-install rights on a WordPress site can add spam pages, hidden links or redirects, and search engines can label sites they detect as harmful. Any of those would affect organic traffic, and cleaning up after the fact takes longer than checking now. A site that turns out to be compromised is worth a technical review once it is clean, and an SEO audit is the usual way to check for injected pages, unexpected redirects and indexing changes.

What this means for Thai marketers

Analysis: if your site was built or is maintained by an outside developer or agency that looks after several client sites, the remote-management angle is the part to check first. If your developer or a previous agency connected your site to an UpdraftCentral cloud account, your site may have held a key you never knew about. Ask whoever maintains the site to confirm the UpdraftPlus version, whether a key exists, and whether any unknown users or plugins appeared after 17 October.

If you are planning a rebuild or a move to a new platform, this incident is a reasonable prompt to decide who holds admin access and which plugins can act on the site remotely. That is part of any web design handover, and it affects how safely your site can support SEO in Thailand over time.

What the sources did not say

TeamUpdraft has not stated how many customer records were accessed, how many sites received backdoors, or the exact weakness that let the attacker in, beyond saying it deployed a fix for the underlying weakness and that a compromised key was used. Patchstack's plugin names and indicators describe the wave it saw; Patchstack itself notes the next wave would use new names. Neither source said whether any data was taken from connected WordPress sites. Readers should treat those points as open until TeamUpdraft updates its page.

FAQ

Is my WordPress site affected if I use UpdraftPlus?

It may be, if the site had an active UpdraftCentral cloud key. TeamUpdraft says free users without a teamupdraft.com account need to take no action, while Patchstack says sites linked to a TeamUpdraft account could hold a key by default, so Premium users and anyone who connected an account should check.

Does updating to UpdraftPlus 1.26.13 or 2.26.13 remove the backdoor?

No, the update only revokes the old UpdraftCentral keys. TeamUpdraft says the attacker created admin accounts and installed malicious plugins on some sites, and you have to find and remove those yourself.

Were my backups or card details exposed?

TeamUpdraft says no card details were stored, because Stripe and PayPal handle payments, and that backups in your own remote storage were not affected. If your site was accessed through UpdraftCentral, it asks you to re-authorise remote storage and change storage access keys as a precaution.

Why would 2FA not have stopped this?

According to Patchstack, the backdoor logs the attacker in by setting a cookie directly, so the login form never runs. That skips two-factor authentication and login attempt limits.

Should I reconnect my site to UpdraftCentral?

TeamUpdraft's steps say to reconnect after securing the site, but Patchstack advised on 19 October not to reconnect until the vendor explains the cause. If you do reconnect, Patchstack suggests creating the key under an account without the install_plugins capability.

The short version: update UpdraftPlus, delete old UpdraftCentral keys, and look for Editor accounts and plugins you did not add. If you would like a second pair of eyes on a WordPress site after this incident, Relevant Audience can review it as part of a web design or technical SEO engagement.