Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites: What to Do

TL;DR - TeamUpdraft, the company behind UpdraftPlus, says an attacker accessed its customer database over the weekend of 17-18 October 2026, including connection keys for UpdraftCentral, UpdraftVault and UpdraftClone, according to its security notice. - Researchers at Patchstack and Nethemba report that stolen UpdraftCentral keys were used to install backdoor plugins on connected WordPress sites. The vendor’s notice does not confirm that. - If a site was connected to UpdraftCentral Cloud: update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later, delete the connection key by hand, and check for unfamiliar administrators and plugins. - Free UpdraftPlus users without a teamupdraft.com account need no action beyond keeping the plugin updated, per the vendor.

What happened#

TeamUpdraft says it detected unauthorized access on 18 October 2026, following activity over the weekend of 17-18 October. In its notice, posted 19 October and last updated 20 October at 16:25 BST, the company says the customer database was accessed. That data included names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.

The company says card details were not exposed because it does not store them, and that UpdraftPlus plugin files and downloads, backups held in customers’ own remote storage, and self-hosted UpdraftCentral were not affected. Its 20 October update says the access was resolved and that reports of an ongoing attack do not match what it has observed.

UpdraftCentral is a remote management service that can run backups and updates and manage users, posts, plugins and themes from one dashboard; its client ships inside UpdraftPlus, according to the plugin’s WordPress.org page. That remote-management channel is what the researchers say was abused.

Patchstack reports that attackers began using the stolen keys on October 18 at 15:32 UTC, sending validly signed commands that installed plugins on connected sites. It says it recorded 99 distinct backdoor plugin names, including “Site Health Cache”. Nethemba reports that three of its own websites were targeted and that malicious plugins were installed on two of them. Nethemba also describes later variants that could create privileged accounts or log an attacker in as an existing administrator, and notes that removing a malicious plugin may not remove an account it created.

Are you affected?#

The exposure applies to WordPress sites that were connected to UpdraftCentral Cloud. Self-hosted UpdraftCentral is not affected, according to TeamUpdraft. Nethemba reports that a site can hold a connection key even if nobody knowingly used UpdraftCentral, because connecting a teamupdraft.com account inside UpdraftPlus can enroll the site.

The two sources describe the plugin update differently. TeamUpdraft says UpdraftPlus 1.26.13 and 2.26.13 disconnect UpdraftCentral connections made before 22:00 BST on 18 October. Nethemba’s analysis says those versions remove only keys created before 13:07 BST (12:07 UTC) on 18 October. Both recommend deleting the key manually, which avoids depending on either reading.

No count of affected accounts or sites has been published. Patchstack and Nethemba cite an estimate that fewer than 10% of UpdraftPlus users have an UpdraftCentral or Migrator key, potentially representing around 400,000 websites.

Separately, Nethemba says the sites it examined ran UpdraftPlus 2.26.11, which was already patched against the June vulnerability CVE-2026-10795. That earlier flaw is a different issue from this key theft.

What is confirmed and what is reported#

What defenders should do now#

1. Find every site that was connected to UpdraftCentral Cloud, including sites where nobody remembers enabling it.
2. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later on each of those sites, logging in to WordPress directly rather than through UpdraftCentral.
3. Delete the UpdraftCentral connection key by hand under UpdraftPlus Advanced Tools, whatever version you are on, as both TeamUpdraft and Nethemba recommend.
4. Check for unfamiliar administrator accounts and plugins, including Must-Use plugins, and change all administrator passwords. TeamUpdraft suggests considering a restore from a backup taken before 17 October if anything looks suspicious.
5. Rotate storage credentials. TeamUpdraft advises UpdraftCentral users to re-authorize remote storage and change storage keys as a precaution.
6. Change the teamupdraft.com account password by typing the address directly, change it anywhere it was reused, and reset two-factor authentication if you use it. Treat unexpected emails about the incident with caution; the company says it will never ask for passwords or keys.
7. UpdraftVault and UpdraftClone users: TeamUpdraft says all Vault sites were disconnected and all Clone client keys were replaced, so reconnect Vault, run a manual backup to confirm it works, and send clients their new Clone keys.

Related reading: WordPress plugin security checklist.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

• Primary notice: TeamUpdraft security incident notice
• Primary notice: UpdraftPlus on WordPress.org
• Research: Patchstack
• Research: Nethemba
• Report: BleepingComputer