Security notice
Stolen UpdraftCentral keys used to backdoor WordPress sites
Over the weekend of 17 and 18 October 2026, an attacker got into TeamUpdraft, the company behind the UpdraftPlus backup plugin, and took the keys that let its UpdraftCentral service manage WordPress sites remotely. They used those keys to install backdoor plugins on connected sites. If a site you run uses UpdraftPlus, update it to 1.26.13 or 2.26.13, delete its UpdraftCentral keys and check it for the signs below.
What's happening
UpdraftPlus is one of the most widely used backup plugins for WordPress. UpdraftCentral is its companion service for managing many sites from one dashboard. It connects to each site with a key, and the site carries out any command signed with that key, including installing a plugin.
Over the weekend of 17 and 18 October 2026, TeamUpdraft found that someone had gained unauthorised access to its website. It believes the attacker reached its customer database, which holds names, email and billing addresses, order history, password hashes, two-factor settings, and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It says it does not store card details.
The stolen UpdraftCentral keys were put to use straight away. Because the commands were properly signed, connected sites accepted them. Patchstack, which monitors WordPress sites for attacks, recorded backdoor plugins being installed over about 18 hours on 18 and 19 October, and counted 99 different ones, most with harmless sounding names such as "Site Health Cache".
Each backdoor waits for a secret code in a web address. When it sees it, it creates a user with enough permissions to install plugins and change settings, then logs the attacker in directly, skipping the login form and any two-factor check. That user stays behind even after the plugin is removed. Patchstack is clear that this is not a flaw in the plugin's code: the attacker simply held valid keys.
You can read Patchstack's analysis, which lists every backdoor plugin name it has seen.
Who is at risk
- Any WordPress site running UpdraftPlus, free or Premium, that has an UpdraftCentral key. That includes sites connected to UpdraftCentral's cloud dashboard, and sites where someone signed in to a TeamUpdraft account from inside the plugin, because the box that adds the site to UpdraftCentral is ticked by default. Check even if you never meant to use UpdraftCentral.
- Sites on UpdraftPlus 1.26.12 or 2.26.12. That release was meant to remove the old keys, but a bug meant it removed none.
- Sites where a backdoor was installed but never switched on. Some failed to activate, and Patchstack says to treat those sites as affected anyway.
TeamUpdraft says self-hosted UpdraftCentral, the plugin downloads themselves, and backups kept in your own storage, such as Google Drive, Dropbox or Amazon S3, were not affected.
What to do if you run UpdraftPlus
- Update to UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later, not 1.26.12 or 2.26.12. Sign in to each site's own dashboard to do it, rather than going through UpdraftCentral.
- Delete every UpdraftCentral key by hand. Go to Settings, UpdraftPlus Backups, the Advanced Tools tab, UpdraftCentral, then "Manage existing keys" and delete each one. The update removes most old keys but not all of them, and removing the site from the UpdraftCentral dashboard is not enough.
- Look for plugins you don't recognise, including on the Must-Use tab, and for any plugin described as "Small maintenance toolkit: keeps option storage tidy". If you find one, don't try to fix it or delete it from the dashboard. Deactivate it and have it removed from the server.
- Look for users you don't recognise, particularly Editors named with two words and two digits (such as data-ops43 or media-staff96), an @example.org email address, or the display name "Site Tools".
- Change every administrator password, sign everyone out and turn on two-factor authentication.
- If you have a TeamUpdraft account, change its password, and anywhere else you used the same one. If a site was reached through UpdraftCentral, reconnect its remote backup storage and change the storage access keys.
- If you find a backdoor or its user, treat the whole site as compromised. Restore from a backup taken before 17 October and compare the files with a clean copy.
Patchstack advises against reconnecting sites to UpdraftCentral until TeamUpdraft has explained how the keys were taken.
How this affects our clients
None of the WordPress sites we manage use UpdraftPlus or UpdraftCentral, so they were not exposed to this.
It is still a useful reminder. A service that can manage a site remotely is only as safe as the keys it holds, and anyone who takes them can do whatever the service can. One of our Jigsaw sites has no plugins to install and no admin login to add a user to, so a stolen key has nothing to work with. Jigsaw is our own website platform, the one we build on and move clients onto in place of WordPress for most small business sites, and you can read more about it here.
If you run UpdraftPlus on a site we don't look after and would like a hand checking it, request a chat.
