TeamUpdraft breach: stolen UpdraftCentral keys used to backdoor WordPress sites

Attackers who broke into the website of TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin, appear to have walked away with UpdraftCentral connection keys, and within hours they were using them to install backdoor plugins on customers' sites. TeamUpdraft says it found the intrusion over the weekend of 17-18 October 2026. Security firm Patchstack, which has tracked the attack, says it started at 15:32 UTC on 18 October. Anyone who ever connected a WordPress site to UpdraftCentral should check for the key, delete it and look for rogue administrator accounts today, even if the site never showed a problem.

Key points

• TeamUpdraft says unauthorised access to teamupdraft.com happened over the weekend of 17-18 October 2026 and that it believes its customer database was accessed, including UpdraftCentral, UpdraftVault and UpdraftClone connection keys.
• Patchstack says attackers used valid UpdraftCentral keys to install backdoor plugins from 15:32 UTC on 18 October; it counted 99 different plugin names by 09:23 UTC on 19 October.
• Patchstack classifies this as a key compromise, not a code vulnerability, so no CVE applies; Nethemba, the firm that first analysed it, saw malicious plugins installed on two of its three targeted sites.
• TeamUpdraft says UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), released on 19 October, revoked UpdraftCentral connection keys; deleting the key by hand and checking for rogue admins is still advised.
• BleepingComputer estimates that about 10% of UpdraftPlus sites have an UpdraftCentral or Migrator key, which it says could mean around 400,000 websites.

What happened

TeamUpdraft publishes UpdraftPlus, one of the most widely installed backup plugins for WordPress, along with UpdraftCentral (a dashboard for managing many WordPress sites from one place), UpdraftVault (its storage service) and UpdraftClone (a site-cloning service). In its incident notice, dated 19 October, the company says it found unauthorised access to teamupdraft.com and "believe[s] our customer database was accessed."

The company lists what may have been exposed: names, email addresses, billing addresses, order history, hashed passwords, two-factor authentication settings, and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It says card details are not stored on its systems because Stripe and PayPal handle payments. It also says the UpdraftPlus plugin files and downloads were not affected, nor were backups sitting in customers' own remote storage such as Google Drive, Dropbox or Amazon S3, and that self-hosted UpdraftCentral installations are not affected.

The keys matter because of what they do. An UpdraftCentral key lets the holder send signed remote commands to a connected WordPress site, including a command to upload and activate a plugin. Patchstack's analysis, published on 19 October by its security research lead Dave Jong, says the attacker sent exactly such commands, signed with genuine dashboard private keys. From the site's point of view, the instructions looked legitimate.

Patchstack's timeline runs like this. The first backdoor installation it observed was at 15:32 UTC on 18 October. Nethemba, a security consultancy, noticed the attack in the early hours of 19 October on three of its own WordPress sites and published the primary technical analysis. Patchstack's most recent observed installation was at 09:23 UTC on 19 October, and TeamUpdraft published its incident post around 13:00 UTC that day. Patchstack puts the campaign at about 18 hours at the time of writing. In total it recorded 99 distinct plugin names.

According to BleepingComputer's summary of the Nethemba findings, malicious plugins were installed on two of the three Nethemba sites. Those sites ran WordPress 7.1.3 and UpdraftPlus 2.26.11, a version that already contained the fix for an earlier vulnerability, CVE-2026-10795, so being up to date at that point did not help.

Background

This is not the first time the UpdraftCentral channel has been in the news this year. Patchstack notes that CVE-2026-10795, a forged-command flaw in the same remote-command channel rated CVSS 8.1, was fixed in June 2026 in UpdraftPlus 1.26.5 and 2.26.5. That bug was in code. This incident is different: the code worked as designed, and the secrets that authorise it were stolen from the vendor.

That distinction is why patching alone does not close the door. A fixed plugin cannot tell that a perfectly signed command came from the wrong person. Revoking or deleting the keys is the control that works, and it is why TeamUpdraft's later release and the recommended manual cleanup are both needed.

We also covered another WordPress plugin security incident, Rank Math Pro 3.0.123, if you want to compare how vendors handled it.

How the backdoor works

Patchstack's description of the malicious plugins is detailed enough to act on. Every sample it saw carries the same plugin description, "Small maintenance toolkit: keeps option storage tidy." A plugin named "Site Health Cache" recurs most often; the other names are mostly randomised, so Patchstack recommends searching for the description line, not the name.

Once active, the plugin watches incoming requests for a secret URL parameter carrying a 32-character token. When a request includes it, the plugin creates a hidden user account with a hard-coded password, gives it the Editor role, then adds the manage_options and install_plugins capabilities, which are effectively administrator powers. It then logs the visitor in with a persistent cookie. Because that login skips the normal form, two-factor authentication and login-limit plugins do not get a chance to stop it.

Three details deserve attention:

1. The hidden account persists after the plugin is removed, so deleting the plugin is not enough.
2. Some samples contain a coding error that causes HTTP 500 errors. Patchstack warns against fixing such a plugin, because repairing the error would switch the backdoor on.
3. A minority of installations never activated, but Patchstack says those sites are still affected and should be cleaned.

Patchstack also says the attacker rotated infrastructure and used two source addresses, so blocking IPs is not a sufficient defence. Nethemba, as reported by BleepingComputer, saw a newer variant that can either create privileged accounts or log in as an existing administrator.

Patchstack makes two further claims about how keys were created, both attributed to its own and Nethemba's analysis: a checkbox that is ticked by default in the plugin's admin code enrols a site in UpdraftCentral when a TeamUpdraft.com account is connected, so some owners may hold a key without having deliberately set one up; and keys do not expire, with keys issued in November 2025 still working in October 2026. We have not independently verified either point.

What to do now

The guidance from TeamUpdraft and Patchstack overlaps, with one important difference described in the next section. Steps both support:

• Check whether a key exists, even if you believe you never used UpdraftCentral. Patchstack suggests running wp option get updraft_central_localkeys; any output means a key is stored. TeamUpdraft points to Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys.
• Delete every key. Backups keep working without them (wp option delete updraft_central_localkeys does the same from the command line).
• Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later.
• Look for rogue users and plugins. Query for accounts with the Editor role that also hold manage_options, instead of searching by name. Patchstack lists data-ops43 and media-staff96 as confirmed usernames, plus a display name of "Site Tools" and @example.org email addresses. Check Must-Use plugins too, as TeamUpdraft advises, and look for an option named _sync_token.
• If you find a backdoor: delete the key first, then deactivate the plugin and move it out of the web root, remove the _sync_token option and the hidden account. If the site is compromised, restore from a backup taken before the attack (TeamUpdraft suggests one from before 17 October), compare files against a clean install, rotate all administrator passwords, end sessions and enable two-factor authentication.
• Rotate storage credentials for the remote storage your backups use, as a precaution, and change your teamupdraft.com password (typing the address into the browser yourself, not following an emailed link) and any other service where you reused it. Expect phishing emails that imitate TeamUpdraft.

UpdraftVault users were disconnected by the vendor and must reconnect with new credentials; UpdraftClone client keys were all replaced, so clones using old keys will fail.

Where the sources disagree

The picture is not fully consistent, and readers should know where.

Whether an update fixes it. Patchstack's article, written on 19 October, says: "This is not a vulnerability in UpdraftPlus, and as of 19 October no plugin update stops it." TeamUpdraft says its 19 October release, 1.26.13 / 2.26.13, revoked UpdraftCentral connection keys, and on 20 October (16:25 BST) it added that reports of an ongoing attack are inaccurate and that the unauthorised access has been resolved. Those statements can both be true, since they were made at different times, but they come from different parties with different incentives. Even on TeamUpdraft's account, the update does not remove a backdoor that is already installed.

Which version to install. TeamUpdraft's customer steps first say to update to 1.26.12 / 2.26.12 or later, while its later text names 1.26.13 / 2.26.13 as the release that revoked keys. BleepingComputer, citing Nethemba, reports that the 1.26.12 / 2.26.12 release was meant to remove the UpdraftCentral Cloud keys but a bug prevented it. Installing 1.26.13 / 2.26.13 or newer sidesteps the question.

What it means

For site owners, the immediate lesson is the oldest one in key management: a credential that never expires and is stored by a third party is a liability that grows with time. Keys from November 2025 still working in October 2026 turned a vendor database breach into a direct path onto customer servers.

For agencies and hosts that manage many sites, the exposure is multiplied. BleepingComputer says about 10% of UpdraftPlus sites have an UpdraftCentral or Migrator key, which it says could potentially expose around 400,000 websites. That is an estimate, not a count of compromised sites, and the number actually backdoored is not known. Patchstack counted plugin names, not victims.

For plugin vendors, the incident shows why remote-management channels deserve the same scrutiny as login pages. A signed command to upload a plugin is as powerful as an administrator password, and it should be scoped, expire and be revocable in one step.

What we don't know yet

• How many sites were backdoored. Neither TeamUpdraft nor Patchstack has published a count of victims.
• How the attackers got in to teamupdraft.com. TeamUpdraft says it closed the access route and deployed a fix, but has not described the method. Nethemba's analysis, as relayed by Patchstack, says the keys likely leaked from the UpdraftCentral Cloud environment; that is an inference, not a vendor finding.
• Whether the activity has stopped. Patchstack's last observed installation was at 09:23 UTC on 19 October; TeamUpdraft says the access was resolved by 20 October.
• Who is behind it, and whether the stolen password hashes and billing data are being used elsewhere.
• Whether UpdraftPlus will change how keys are created and expired.

What to watch next

Watch TeamUpdraft's incident page for updates, since it has already been revised once and contains the inconsistencies above. Watch Patchstack's article and Nethemba's analysis for new indicators, and for whether a clean confirmation arrives that the 1.26.13 / 2.26.13 releases fully invalidated old keys. TeamUpdraft also said it reported the incident to the UK's data protection regulator, the ICO, and other authorities, so a regulatory follow-up is possible.

Sources

• TeamUpdraft: security incident, what customers need to know (19 October 2026, updated 20 October)
• Patchstack: Stolen UpdraftCentral keys are backdooring WordPress sites (19 October 2026)
• BleepingComputer: Stolen UpdraftCentral keys used to backdoor WordPress sites (20 October 2026)