UpdraftCentral Breach: WordPress Sites Backdoored

If you run a WordPress site, check it today. Attackers used genuine UpdraftCentral keys to push backdoor plugins onto connected sites over an 18-hour window on 18-19 October, and the trap is this: your site may be connected even if you never knowingly used UpdraftCentral. The UpdraftCentral client ships inside every copy of UpdraftPlus, free and premium, and stays dormant until a key is created. Connecting a TeamUpdraft.com account creates one through a checkbox that is ticked by default, reading “Add this website to UpdraftCentral (remote, centralised control) – free for up to 5 sites”. One account connection can enrol a site its owner never meant to enrol.

UpdraftPlus has over four million active installations. Patchstack estimates around 10% of those sites carry an UpdraftCentral or Migrator key, which would put roughly 400,000 sites within potential exposure. That number is an estimate of exposure, not a count of hacked sites. Nobody has confirmed how many sites were actually backdoored.

Check the Editor list first, not the admin list

Here is the detail that makes this attack nasty. Each delivered plugin is a backdoor that watches for a secret URL parameter carrying a 32-character token. Given that token, it creates an account with a hardcoded password, assigns it the Editor role, then separately grants it manage_options and install_plugins. The account shows up as an Editor, so if you only review your administrator list, you will miss it. It also outlives the plugin, and the attacker knows its password. Login by cookie bypasses the login form, two-factor authentication and login-attempt limits.

There is a second wrinkle. Samples analysed so far carry a coding error that throws a fatal error, an HTTP 500 on every uncached request. Patchstack warns plainly: do not repair such a plugin. Fixing the error switches the backdoor on. Remove it instead. Researchers have also reported a second, working variant that logs the attacker in as the first existing administrator without creating an account at all, though that claim is single-sourced and should be treated as a researcher report, not confirmed fact.

What TeamUpdraft says vs what researchers add

TeamUpdraft identified unauthorised access to its website over the weekend of 17-18 October, closed the access route, signed out every account, and replaced keys and credentials that could have been affected. It believes its customer database was accessed: names, email addresses, billing addresses and order history, account passwords stored only in hashed form, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. It does not store card details. Payments go through Stripe and PayPal. It also reported the incident to the UK Information Commissioner’s Office.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which it says automatically disconnect every UpdraftCentral connection made before 22:00 BST on 18 October. In its 20 October update it says the unauthorised access was resolved and the update revoked the connection keys. Researchers add three things the vendor checklist does not cover. Our comparison, built only from the two published checklists:

Check	TeamUpdraft checklist says	Researchers add
Look for unknown accounts	Check Users for unrecognised administrator accounts	Also search by capability: an Editor account holding manage_options and install_plugins is the backdoor account. An admin-only review misses it.
Look for unknown plugins	Check Plugins, including the Must-Use tab	Also search files for the description “Small maintenance toolkit: keeps option storage tidy.” and for the 99 observed names, including “Site Health Cache”.
Remove the threat	Delete the UpdraftCentral key; remove unknown plugins	Delete the key FIRST, or the attacker pushes a corrected replacement. Do not “fix” a crashing backdoor plugin. Remove the backdoor account and its sync token. If the account exists or the trigger appears in access logs, treat the site as fully compromised and restore from a backup taken before 17 October.

How the weekend unfolded

Our reconstruction, from the published sources, with each source’s own timezone labels kept as stated:

17-18 October: TeamUpdraft identifies unauthorised access to its website.
18 October, 15:32 UTC: First backdoor installation observed in Patchstack telemetry.
18-19 October: An 18-hour campaign runs, with 99 distinct backdoor plugin names observed. “Site Health Cache” is reused repeatedly and is the strongest name-based indicator. Patchstack published the full list of all 99 names.
19 October, 09:23: Most recent installation observed. Patchstack’s timeline gives no timezone for this entry, unlike its status lines, which are labelled UTC.
19 October: TeamUpdraft publishes its advisory. UpdraftPlus 1.26.13 and 2.26.13 go out just after 22:00 BST. That is the release time; the cutoff it enforces is 22:00 BST on 18 October, a different moment.
20 October, 16:25 BST: TeamUpdraft says the access was resolved and the keys revoked. Researcher coverage on 20-21 October still disputes the cutoff.

This is the second incident in this channel in five months. In June 2026 the vendor fixed CVE-2026-10795 (CVSS 8.1) in UpdraftPlus 1.26.5 and 2.26.5, where an obsolete unsigned message format let an attacker forge UpdraftCentral commands with no keys at all. The current attack works differently from a normal plugin flaw. The commands are correctly encrypted and signed with genuine dashboard private keys, so every check in the plugin passes. That is why a trusted channel is the hardest kind of breach to spot.

The cutoff both sides disagree on

Here the record is genuinely unresolved, and the article should not pick a side for you. TeamUpdraft says the 1.26.13 and 2.26.13 release disconnects every UpdraftCentral connection made before 22:00 BST on 18 October. Independent coverage reports the emergency release revokes keys created before 8:07 a.m. ET on 18 October, and that keys issued in the hours between the two cutoffs survive the update, with the first observed backdoor installation falling inside that gap. The timezone labels differ across sources, and the two cutoffs are not the same moment. If your site’s key was created on 18 October, do not assume the update alone protected you. Delete the key yourself.

What should I do if my site uses UpdraftPlus?

Work through these in order. Deleting the key comes first, because everything else can be undone by the attacker while the key lives.

Delete every UpdraftCentral key on the site itself, in wp-admin under UpdraftPlus Backups, Advanced Tools, UpdraftCentral, Manage existing keys.
Update UpdraftPlus to 1.26.13 free or 2.26.13 Premium, and confirm the update completed.
Review every user account by capability, not just the administrator list, and remove any Editor holding manage_options.
Search your plugins, including Must-Use, for “Site Health Cache” and any plugin you did not install.
Search files for the description “Small maintenance toolkit: keeps option storage tidy.”
Remove any backdoor plugin outright, and never repair a plugin that throws a fatal error.
Change every administrator password, and review login activity from 17 October onward.
Search your access logs for requests carrying a secret URL parameter with a 32-character token.
Change your teamupdraft.com account password and reset its two-factor authentication, since the customer database was accessed.
Restore from a backup taken before 17 October if a backdoor account or trigger appears.

Deleting the key does not break your backups. Only remote management stops. Backups sent to your own remote storage, such as Google Drive, Dropbox or Amazon S3, are not affected. The UpdraftPlus plugin itself and its downloads were not affected, and self-hosted UpdraftCentral is not affected. TeamUpdraft also disconnected every site from UpdraftVault, so backups will not reach Vault until reconnected. Reconnect Vault and confirm backups are actually running again, or you may discover weeks later that nothing was backing up. It replaced every UpdraftClone client key.

What is still unknown

Three things remain genuinely open. Nobody has confirmed how many sites were actually compromised, as opposed to exposed. The key cutoff dispute is unresolved. And a second, working backdoor variant has been reported by researchers but not yet confirmed by the vendor or a second independent outlet. We will update this article as those answers land, and the update will be marked here when it happens.

Sources: TeamUpdraft advisory, “TeamUpdraft security incident: What customers need to know” (teamupdraft.com); Patchstack, “Stolen UpdraftCentral Keys Are Backdooring WordPress Sites” (patchstack.com); BleepingComputer, “Stolen UpdraftCentral keys used to backdoor WordPress sites” (bleepingcomputer.com).