UpdraftCentral Incident: Stolen Connection Keys Used to Backdoor WordPress Sites. Update UpdraftPlus and Delete Old Keys

TL;DR: TeamUpdraft, the company behind the UpdraftPlus backup plugin, says it identified unauthorised access to teamupdraft.com over the weekend of 17–18 October 2026 and that it believes its customer database was accessed. That database held connection keys for UpdraftCentral (cloud), its remote site-management service (TeamUpdraft). TeamUpdraft says the attacker then used that connection to customers' sites "to create admin accounts, install malicious plugins etc", and that "the extent of that is unknown". Nethemba, which first reported the activity, and Patchstack describe the delivered plugins as backdoors. This is a key compromise, not a software flaw. There is no CVE, and the incident is not in CISA's KEV catalog. What to do (Rescana guidance, based on TeamUpdraft's and the researchers' advice): make sure every site runs UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later, check for and delete any leftover UpdraftCentral keys, and check every connected site directly for administrator or editor accounts and plugins you do not recognise.

What lowers the urgency for most readers:

• Self-hosted UpdraftCentral is not affected, according to TeamUpdraft. The exposed keys belong to the cloud-hosted UpdraftCentral service.
• The UpdraftPlus plugin and its downloads were not tampered with. TeamUpdraft says the plugin "and its downloads were not affected", and that backups sent to your own remote storage (such as Google Drive, Dropbox or Amazon S3) "are not affected".
• No card data. TeamUpdraft says it does not store card details; payments go through Stripe and PayPal. Account passwords were stored "only in hashed (scrambled) form".
• An update revokes old keys. UpdraftPlus 1.26.13 / 2.26.13, released on 19 October and pushed to sites by WordPress.org according to TeamUpdraft, disconnects UpdraftCentral connections made before the vendor's cutoff of 13:07 BST on 18 October. Nethemba says keys created on 18 October between 12:07 and 21:00 UTC are not removed (see below). TeamUpdraft also says it closed the access route and there is "currently no evidence the attacker still has access" to its site.
• A key on the site is required. TeamUpdraft says free UpdraftPlus users without a teamupdraft.com account "don't need to take any action". Wordfence notes that the UpdraftCentral client inside UpdraftPlus "does not accept UpdraftCentral commands unless a connection key exists on the site" (Wordfence).

The catch: a stolen key keeps working until it is deleted from the site itself, and revoking it does not undo what the attacker already did. Researchers also report that many sites hold an UpdraftCentral key their owners never knowingly created (details below). TeamUpdraft itself now asks UpdraftPlus Premium users to check their sites "even if you've never used UpdraftCentral".

Technical Information

UpdraftCentral lets administrators manage many WordPress sites from one dashboard. Its client ships inside every copy of UpdraftPlus, free and Premium. When a site is connected, it trusts commands signed with the dashboard's key and runs them with the permissions of the WordPress user who created the connection (Wordfence; Patchstack). For the cloud service, those dashboard keys are held by TeamUpdraft. That is why theft from the vendor's database turned into access to customer sites.

TeamUpdraft lists the data it believes was accessed as names, email addresses, billing addresses and order history; hashed account passwords; two-factor authentication settings; and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. On 21 October the vendor added that "the attacker used a compromised key to access our site", and that the speed of the follow-on attacks and "initially faulty backdoor plugins suggest that the hackers used AI to accelerate their attack". That is TeamUpdraft's assessment; it has not published evidence for it. TeamUpdraft says it has brought in an external cyber security firm, reported the incident to the UK Information Commissioner's Office (ICO) and contacted the police.

What the researchers saw (attributed vendor research):

• Patchstack says its telemetry recorded backdoor plugins being installed between 18 October 15:32 and 19 October 09:23 (Patchstack gives no time zone). It observed 99 distinct backdoor plugin names, mostly random two- or three-word names, and says it is "not a vulnerability in UpdraftPlus": the commands were "correctly encrypted and signed with genuine dashboard private keys", so recent plugin versions were "affected exactly like older ones" (Patchstack).
• According to Patchstack, the backdoor creates an account that appears as an Editor but has been given extra capabilities that let it install plugins and change site settings. It logs in by setting a cookie directly, which bypasses the login form, so two-factor authentication and login-protection plugins do not apply. The account remains after the plugin is removed. Patchstack says the samples it analysed had a coding error that crashed affected sites, which is how the first victims noticed.
• Nethemba reported that three WordPress sites it runs received remote-management commands from the attacker on the night of 19 October. The backdoor was installed on two of them; on the third, it failed because the key belonged to a user without permission to install plugins. All three were on current WordPress and UpdraftPlus versions (Nethemba). Nethemba says it has since received samples of three backdoor variants from other administrators, and that one variant hides itself from the plugin list.
• Wordfence says reports sent to it describe malicious plugin installs on sites running UpdraftPlus Premium 2.26.11.x and UpdraftPlus Free 1.26.10 or 1.26.11 (Wordfence).

Default enrolment. Patchstack and Nethemba both report that the screen for connecting UpdraftPlus to a teamupdraft.com account has an "Add this website to UpdraftCentral" checkbox that is ticked by default. So a site can hold a key even if its owner only ever used UpdraftPlus for backups. Patchstack adds that keys do not expire. TeamUpdraft's page does not mention the checkbox (checked 22 October, 18:03 Cyprus time (UTC+3)). Its 21 October advice to check Premium sites "even if you've never used UpdraftCentral" is consistent with the researchers' finding.

The revocation release. UpdraftPlus 1.26.12 / 2.26.12 was published on 19 October to revoke UpdraftCentral Cloud keys created before the incident. Later that day 1.26.13 / 2.26.13 followed, with the changelog entry "Properly apply the revocation in 1.26.12" (WordPress.org changelog). Nethemba says a bug meant 1.26.12 deleted no keys, and advises treating 1.26.13 / 2.26.13 as the minimum. TeamUpdraft's numbered remediation steps still say 1.26.12 / 2.26.12, while its "What we have already done" list and later updates name 1.26.13 / 2.26.13. Nethemba also reports: "Even 1.26.13 does not delete keys created on 18 October between 12:07 and 21:00 UTC" (15:07 to 00:00 Cyprus time (UTC+3)), "although the vendor's statement named 22:00 BST (21:00 UTC) as the cutoff". That was TeamUpdraft's earlier wording. TeamUpdraft's page now gives 13:07 BST; the visible update stamp is unchanged. The page says 1.26.13 / 2.26.13 "automatically disconnect every UpdraftCentral connection made before 13:07 BST on 18 October" (12:07 UTC, 15:07 Cyprus time), which is the start of the period Nethemba describes. It does not say what happens to keys created after that time, and it does not mention Nethemba. Nethemba says that, as of 22 October, the vendor "did not comment on the revocation cutoff". The page's dateModified is 17:48 Cyprus time on 22 October; its visible "Last updated" stamp still reads 14:42 BST (16:42 Cyprus time) (checked 18:03 Cyprus time (UTC+3)). Deleting keys by hand covers any key the update leaves on a site.

Is the attacker still active? TeamUpdraft says there is no evidence the attacker still has access to teamupdraft.com. Separately, Nethemba reports that the attacker sent UpdraftCentral commands to two of its sites again on 21 October, between 10:10 and 12:21 Cyprus time (UTC+3), after the revocation release. Those commands failed because the keys had already been deleted. Nethemba's conclusion is that leaked keys keep working on any site that has neither updated nor deleted them.

Severity and status. No CVE has been assigned, so there is no NVD or vendor CVSS score, and we do not use a severity label for this post. The incident is not in CISA's KEV catalog (catalog version 2026.10.21, checked 22 October 2026 at 18:03 Cyprus time (UTC+3)). We found no national CERT advisory on it (CISA, CERT-EU, NCSC UK and CERT-FR checked at 17:17; CERT.at's 20 October daily summary only links the vendor notice), and no WordPress.org statement beyond the pushed update. This is a separate issue from CVE-2026-10795 (CVSS 3.1 8.1, Wordfence as CNA), the June 2026 UpdraftCentral authentication bypass fixed in UpdraftPlus 1.26.5. Nethemba says its sites were patched against CVE-2026-10795 and were still hit. Patchstack notes that sites below 1.26.5 / 2.26.5 face both problems.

Timeline

All dates are 2026. Times are Cyprus time (UTC+3), converted from the time zone each source uses.

• 17–18 October (weekend): TeamUpdraft identifies unauthorised access to teamupdraft.com.
• 18 October 15:32 to 19 October 09:23 (Patchstack gives no time zone): backdoor installations recorded in Patchstack telemetry.
• 19 October, 01:41–07:53: attacker commands reach Nethemba's three sites; backdoors are installed on two of them (Nethemba, converted from CEST).
• 19 October: TeamUpdraft publishes its incident notice (Patchstack notes it at 16:00). Nethemba publishes its analysis and reports the activity to TeamUpdraft. Patchstack deploys mitigation rules. UpdraftPlus 1.26.12 / 2.26.12 is released.
• 19 October, 23:02: Wordfence publishes its PSA and an emergency firewall rule, which it released to Wordfence Free users early.
• 19 October, 23:57: WordPress.org records the free 1.26.13. TeamUpdraft says the 1.26.13 / 2.26.13 release was published "just after 10pm BST" (just after 00:00 Cyprus time on 20 October).
• 20 October, 18:25: TeamUpdraft says the unauthorised access "was resolved" and that WordPress.org has pushed the update to all users.
• 21 October, 12:23 and 17:35: TeamUpdraft posts a list of established facts. It asks Premium users to check their sites even if they never used UpdraftCentral, and temporarily takes its support form offline.
• 22 October, 16:42: TeamUpdraft's latest update says its support form is back online and asks users to check the sites listed in their UpdraftCentral dashboard for unexpected users ("we're seeing a pattern of unexpected 'editor' roles especially"), unrecognised plugins and IPs they do not recognise in the logs.
• 22 October, 17:48: TeamUpdraft revises the page (its dateModified), rewording the 16:42 update and changing the stated revocation cutoff to 13:07 BST on 18 October. The visible "Last updated" stamp still reads 14:42 BST.

Affected Product Versions

• At risk: WordPress sites running UpdraftPlus (free or Premium, any version before 1.26.13 / 2.26.13) that hold a key for the cloud-hosted UpdraftCentral service. TeamUpdraft says 1.26.13 / 2.26.13 disconnects connections made before 13:07 BST (12:07 UTC) on 18 October; Nethemba says keys created on 18 October between 12:07 and 21:00 UTC survive 1.26.13 (see Technical Information).
• Not affected, per TeamUpdraft: self-hosted UpdraftCentral; the UpdraftPlus plugin code and downloads; backups stored in your own remote storage.
• Fixed: UpdraftPlus 1.26.13 (free) / 2.26.13 (Premium) or later revokes the older cloud keys, per TeamUpdraft. This does not remove anything an attacker already installed.
• Other TeamUpdraft services: TeamUpdraft says it has disconnected all sites from UpdraftVault and issued new credentials, so backups will not reach Vault until you reconnect. It has also replaced every UpdraftClone client key.
• teamupdraft.com accounts: all accounts were signed out. TeamUpdraft asks every account holder to change their password and reset two-factor authentication.

Workaround and Mitigation

Vendor steps (TeamUpdraft, for UpdraftCentral cloud users)

TeamUpdraft asks UpdraftCentral (cloud) users to "please do this today" for each site:

1. Log in to the site's own WordPress dashboard, not through UpdraftCentral.
2. Update UpdraftPlus. The vendor's original step says 1.26.12 / 2.26.12 or later; its later updates and the WordPress.org changelog point to 1.26.13 / 2.26.13. Rescana guidance: install the latest available release; WordPress.org lists 1.26.13 as current (checked 22 October, 18:03 Cyprus time (UTC+3)).
3. Delete the connection key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral.
4. Check Users for unrecognised administrator accounts and remove them. On 22 October TeamUpdraft added that it is "seeing a pattern of unexpected 'editor' roles especially".
5. Check Plugins, including the Must-Use tab, and remove anything you do not recognise.
6. Change the passwords of all administrator accounts.
7. If you find anything suspicious, consider restoring from a backup taken before 17 October.
8. Reconnect the site to UpdraftCentral.

TeamUpdraft also asks UpdraftCentral users to log in through My Account and look at the sites listed in their dashboard, saying "Any site listed before this incident has potentially been exposed to the attacker". If a site was accessed through UpdraftCentral, it recommends re-authorising remote storage and changing storage access keys as a precaution. Everyone with a teamupdraft.com account should change their password (typing the address rather than following a link), change it anywhere else it was reused, reset two-factor authentication, and be cautious of unexpected emails claiming to be from TeamUpdraft.

What the researchers add (attributed)

• Check for a key on every site, even if you never used UpdraftCentral (Patchstack, Nethemba). Patchstack says removing a site from the dashboard "is not enough – the key that matters lives on the site", and that backups keep working after the key is deleted.
• Look for the hidden admin by capability, not by role name. The backdoor account shows as an Editor (Patchstack).
• Remove a backdoor plugin; do not "fix" it. Patchstack says repairing the crashing plugin "switches the backdoor on". It also says to delete the UpdraftCentral key first, or the attacker can push a replacement. Nethemba reports seeing exactly that on another administrator's site.
• Firewall rules. Wordfence and Patchstack have both deployed rules that block UpdraftCentral remote commands. Wordfence says its rule blocks legitimate commands too but "does not interfere with ordinary UpdraftPlus backups", and that firewall protection "cannot undo a compromise that occurred before the rule was deployed".

Rescana guidance

• Inventory first. Make a list of every WordPress site you or your agencies run, including staging and rarely used sites, and record which ones run UpdraftPlus and which have ever been connected to UpdraftCentral (cloud).
• Treat confirmed backdoors as a full compromise. If you find a backdoor account or plugin, restore from a known-good backup taken before 17 October, rotate all admin, hosting and storage credentials, and end active sessions. Do not just delete the plugin and move on.
• Hold off on reconnecting high-value sites. Reconnect only after a site has been checked, and where possible connect with a user that cannot install plugins. Patchstack says that single detail stopped the attack on one analysed site.
• Exposure is not compromise. A site with an old key was exposed. It was not necessarily backdoored. Check it before assuming either.

Indicators of Compromise

These indicators were published by Patchstack and Nethemba. They are defanged here and cover the October wave only. Patchstack warns the attacker rotates infrastructure and names, so "IP blocking is not a control here".

• Source addresses (Patchstack, Nethemba): 43.250.53[.]42; 2a09:bac5:4e21:2e3c[::]49b:9
• Plugin description (Patchstack, "the most reliable file-level indicator"): "Small maintenance toolkit: keeps option storage tidy."
• Recurring plugin name (Patchstack): "Site Health Cache". Nethemba says this variant hides itself from the plugin list. Patchstack's article lists the other names it observed.
• Backdoor account (Patchstack, Nethemba): shows as an Editor but holds extra capabilities. Confirmed usernames so far are data-ops43 and media-staff96, and Patchstack says to "assume other names exist". Other markers are the display name "Site Tools", an email address at example[.]org, and a database option ending in _sync_token.
• Sample hashes (Nethemba, SHA-256 of the main plugin file, two analysed sites): 3c3355f7692d4951e5655683783795579467c9bf1ae2152e13b8c80e9021209f, bb40f9a87cea678aa50e5286dd91c0903d6a7fc1b12391472187a0919b4d0801. Patchstack and Nethemba both say names, tokens and authors change between samples, so hashes will not catch every variant.
• Logs (Patchstack): plugin-upload commands in the UpdraftCentral client log that nobody on your team sent; plugin installs with no matching administrator action; WordPress error emails naming a plugin you do not recognise.

TeamUpdraft has not published its own indicators. No source maps the activity to MITRE ATT&CK, and we have not done so either.

What we will update: We will update this post if TeamUpdraft publishes a root cause or its own indicators, responds to Nethemba's report on the revocation cutoff, or ships a new UpdraftPlus release; if a CVE is assigned; or if a national CERT or the ICO issues a statement.

Sources

• TeamUpdraft: TeamUpdraft security incident: What customers need to know (posted 19 Oct 2026; "Last updated" stamp 22 Oct 2026, 14:42 BST / 16:42 Cyprus time; page revised 22 Oct 2026, 17:48 Cyprus time (UTC+3)); UpdraftPlus changelog on WordPress.org (1.26.12 and 1.26.13, 19 Oct 2026)
• Patchstack: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites (19 Oct 2026)
• Nethemba: UpdraftCentral backdoor analysis (19 Oct 2026, updated 22 Oct 2026)
• Wordfence: PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites (19 Oct 2026)
• NVD: CVE-2026-10795, the earlier, separate UpdraftPlus flaw

Why this matters for vendor risk

Here a breach at one supplier became a path into its customers' websites, through keys the supplier held, including for sites that many owners did not know were connected. If an agency or MSP runs your WordPress sites, your exposure may sit with them rather than with your own team.

Forward this to your TPRM owner: Ask your web agencies and MSPs whether they manage your WordPress sites through UpdraftCentral (cloud) or another central dashboard, and which sites are connected; whether every site is on UpdraftPlus 1.26.13 / 2.26.13 or later with old UpdraftCentral keys deleted by hand; what their checks for unknown plugins, Must-Use plugins and editor or admin accounts found; and how quickly they would tell you if a tool they use to manage your assets reported a security incident (Rescana guidance).

Want a fast, evidence-based view of which suppliers in your chain depend on remote-management tools like this, and how quickly they respond to incidents? Book a demo.