UpdraftPlus users: how to check if the UpdraftCentral breach reached your site

If your WordPress site uses UpdraftPlus, you may have seen the news: attackers broke into TeamUpdraft’s website, the company behind UpdraftPlus, and used stolen UpdraftCentral keys to install backdoors on WordPress sites. The plugin itself wasn’t hacked, but some sites that use it were. Here’s what happened, how to tell whether your site is one of them, and what to do if it is.

The short answer

• Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or newer. This version cuts off the stolen keys. WordPress.org pushed it out automatically, but check.
• Updating does not remove a backdoor that’s already there. If your site was connected to UpdraftCentral’s cloud service on 18–19 October, check it by hand.
• Check your users and plugins, including Editor accounts, not just administrators. The attacker’s account was disguised as an Editor.
• UpdraftPlus Premium users should check even if they’ve never used UpdraftCentral. Connecting your TeamUpdraft account inside the plugin could enrol a site without you noticing.

What happened

Over the weekend of 17–18 October 2026, someone gained unauthorised access to teamupdraft.com. TeamUpdraft says the attacker likely reached its customer database, which holds names, email and billing addresses, order history, hashed passwords, two-factor settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card details weren’t stored there.

UpdraftCentral is TeamUpdraft’s remote management service, and its client is built into every copy of UpdraftPlus. A site connected to it accepts commands signed with the matching key. With those keys, the attacker could send commands that looked completely legitimate to the connected sites.

Security firm Patchstack recorded backdoor plugins being installed on connected sites from the afternoon of 18 October to the morning of 19 October. Nethemba, a Slovak security company, spotted the attack on its own sites and published the first analysis.

TeamUpdraft closed the access route, signed out every account, replaced affected keys and, late on 19 October, released UpdraftPlus 1.26.13 and 2.26.13, which disconnect the old UpdraftCentral connections so the stolen keys stop working.

Is your site affected?

Your site may have been reached if both of these were true during the attack:

1. UpdraftPlus (free or Premium) was installed and active.
2. The site had an active connection key for TeamUpdraft’s cloud UpdraftCentral service.

The second point is easy to miss. According to Patchstack, when you connect your TeamUpdraft account inside UpdraftPlus, an option to add the site to UpdraftCentral is ticked by default. Many site owners who only use UpdraftPlus for backups had a key without knowing it.

These are not affected, according to TeamUpdraft:

• the UpdraftPlus plugin code and its downloads
• backups stored in your own Google Drive, Dropbox, Amazon S3 or similar
• self-hosted UpdraftCentral

If you use the free plugin and have never connected a TeamUpdraft account, TeamUpdraft says you don’t need to take action beyond keeping the plugin updated.

How the backdoor works

Using a stolen key, the attacker told each site to install and activate a small plugin. That plugin waits for a secret link and, when it’s visited, creates a user account with a password the attacker knows.

The account is listed as an Editor, so a quick look at your administrators won’t show it. Behind the scenes it’s given extra permissions to install plugins and change site settings, which is enough to take full control. It also logs the attacker in directly, skipping the normal login form, so two-factor authentication and login limits don’t stop it.

Two details matter for cleanup. The account stays on your site even after the plugin is removed. And early versions of the plugin had a bug that crashed affected sites with a 500 error; the attacker later replaced them with working versions.

How to check your site

Do this for every site that runs UpdraftPlus, including sites you don’t look at often.

1. Log in to the site’s own WordPress dashboard, not through UpdraftCentral.
2. Check the UpdraftPlus version under Plugins. It should be 1.26.13 (free) or 2.26.13 (Premium) or newer.
3. Delete any UpdraftCentral keys. Go to Settings › UpdraftPlus Backups › Advanced Tools › UpdraftCentral, open the list of existing keys and delete them all. Removing the site from your UpdraftCentral dashboard isn’t enough; the key that matters lives on the site. Your backups keep working.
4. Check your plugins, including the Must-Use tab if you see one. Look for anything you didn’t install, especially a plugin called “Site Health Cache” or any plugin whose description reads “Small maintenance toolkit: keeps option storage tidy.”
5. Check your users. Filter by the Editor role as well as Administrator, and look for any account you don’t recognise.
6. Tighten up access once you’re sure the site is clean: change all administrator passwords, turn on two-factor authentication, and change your teamupdraft.com password.
7. Re-authorise remote backup storage (Google Drive, Dropbox, S3 and so on) and change its access keys if the site was connected to UpdraftCentral. TeamUpdraft recommends this as a precaution.

For developers with WP-CLI access: wp option get updraft_central_localkeys shows whether a site still holds an UpdraftCentral key (any output means it does), and wp option delete updraft_central_localkeys removes it. To sweep a server for the backdoor, search the plugins folder for the description line above.

Signs your site was backdoored

These are the indicators security researchers have published so far. The attacker used many different plugin and user names, so a clean result on names alone doesn’t prove a site is safe.

If you find a backdoor

Order matters here, and a couple of the obvious moves make things worse.

1. Delete the UpdraftCentral keys first. Otherwise the attacker can push a replacement backdoor.
2. Don’t try to fix the plugin’s errors. Fixing the bug switches the backdoor on.
3. Don’t delete the plugin from the WordPress dashboard either. Its uninstall routine erases its own traces. Deactivate it, then move its folder out of the website’s files using your host’s file manager or SFTP.
4. Remove the attacker’s user account and the _sync_token database option.
5. Treat the whole site as compromised. Restore from a backup taken before 17 October if you can, compare your files against clean copies of WordPress, your theme and plugins, review every user with extra permissions, change every password (WordPress, hosting, database), log out all sessions and turn on two-factor authentication.

Should you reconnect UpdraftCentral?

TeamUpdraft says you can reconnect once a site is checked and cleaned. Patchstack suggests waiting until the vendor fully explains the cause, and if you do need remote management, creating the connection under a WordPress user that can’t install plugins. On one of the sites that was analysed, that alone stopped the attack.

If you don’t actively use UpdraftCentral, there’s no reason to reconnect. Your backups work without it.

It’s also worth making sure every site is on UpdraftPlus 1.26.5 / 2.26.5 or newer at the very least. Those versions fixed a separate UpdraftCentral flaw in June 2026 (CVE-2026-10795), and Patchstack says attackers are still trying it on older sites.

A busy week for WordPress security

This happened in the same week as a critical security fix to PHP, the language WordPress runs on. If you’re checking your site anyway, check its PHP version too.

If I already look after your site

If your site is on one of my maintenance plans, I’m checking it for these signs and will contact you directly if anything needs attention.

How I can help

If you’d rather hand this over, there are three ways I can help:

1. Free breach check. I check whether your site held an UpdraftCentral key and look for the signs listed above. You get a plain-English answer within one business day.
2. Backdoor cleanup and recovery. If something’s found, I remove it in the right order, check for anything else the attacker left, and lock the site down. You get a fixed quote before any work starts, with no hidden fees.
3. Ongoing care. My website maintenance and care plans cover updates, backups, security checks and alerts like this one, handled for you.

Sources

• TeamUpdraft: security incident, what customers need to know
• Patchstack: stolen UpdraftCentral keys are backdooring WordPress sites
• Nethemba: UpdraftCentral backdoor analysis
• Wordfence: UpdraftCentral connection key compromise
• The Hacker News: attackers abuse UpdraftCentral keys to plant backdoors