Stolen UpdraftCentral keys used to backdoor WordPress sites after TeamUpdraft breach

On 18 October 2026, TeamUpdraft — the UK-based developer behind the widely used UpdraftPlus WordPress backup plugin, which has more than 4 million downloads — disclosed that attackers had breached its website and were using stolen connection keys to plant backdoors on customers' sites. "Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website," the company said, adding that it had closed the access route, signed out every account, and replaced the affected keys and credentials.

The company believes the intruders accessed its customer database, including password hashes, two-factor-authentication settings, and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone; no payment details were stored. UpdraftCentral is a dashboard for managing many WordPress sites remotely, so the stolen keys could be used to send commands to every site still connected to a compromised account.

Exploitation in the wild

Security firm Patchstack said attacks began on 18 October at 15:32 UTC, with attackers using the stolen keys to execute code and create full-administrator accounts on affected sites. Patchstack logged at least 99 malicious backdoor plugins disguised as maintenance tools — one, for example, named "Site Health Cache." Researchers at Nethemba reported that three of their own sites were targeted and that rogue plugins were installed on two of them, even though all three ran patched plugin versions. TeamUpdraft estimated that roughly 10% of UpdraftPlus sites hold an UpdraftCentral or Migrator key, putting on the order of 400,000 websites potentially within reach.

Remediation

TeamUpdraft's first fix (versions 1.26.12 and 2.26.12) contained a bug that failed to remove UpdraftCentral Cloud keys, so the company urged users to update to 1.26.13 (free) or 2.26.13 (Premium), delete their UpdraftCentral connection keys, rotate storage credentials, and reauthorise their connections. Site owners who may have been compromised were told to restore from clean backups, change their TeamUpdraft account password, revoke all sessions, and reset two-factor authentication. The UpdraftPlus plugin files and downloads themselves were not altered, and self-hosted UpdraftCentral instances were not impacted — the danger lay entirely in the stolen remote-control keys.