UpdraftPlus security incident: why updating alone is not enough

WordPress site owners using UpdraftPlus should check their UpdraftCentral connections and inspect their sites for unexpected changes, even if they have already updated the plugin. The update revokes older UpdraftCentral keys, but researchers found a window of keys it misses, and it does not clean a site that was already compromised.

The answer in brief

• An attacker took UpdraftCentral connection keys from TeamUpdraft over the weekend of 17 and 18 October 2026 and used them to install backdoor plugins on connected WordPress sites.
• Update to UpdraftPlus 1.26.13 (free), 2.26.13 (Premium) or later. Nethemba found that the first emergency releases, 1.26.12 and 2.26.12, removed no keys because of a bug.
• Delete the UpdraftCentral key by hand as well. Nethemba reports that keys created between 12:07 and 21:00 UTC on 18 October survive the update. As of 24 October 2026, WordPress.org still lists 1.26.13 as the current free version.
• Then check users, plugins and the server’s access log. The update does not remove a backdoor or an account that is already on the site.
• TeamUpdraft says free UpdraftPlus users without a teamupdraft.com account need take no action beyond keeping the plugin up to date, and that self-hosted UpdraftCentral is not affected.

What happened at TeamUpdraft?

TeamUpdraft’s incident notice confirms unauthorised access to its website over the weekend of 17 and 18 October. The company believes its customer database was accessed, including connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft is registered in Newport, Wales, and has reported the incident to the Information Commissioner’s Office.

Patchstack’s investigation describes attackers sending signed commands with those keys to install malicious plugins on connected sites. Because the commands were signed with trusted keys, the plugin accepted them as legitimate. Patchstack also found that the keys do not expire: keys issued in November 2025 still worked in October 2026.

Could your site have a connection you did not create?

Yes. An UpdraftCentral key can exist even where the owner only meant to use UpdraftPlus for backups.

Nethemba’s analysis and Patchstack both found that the option “Add this website to UpdraftCentral” is ticked by default when someone connects a teamupdraft.com account inside the plugin, in the free and Premium editions, provided the site has no key already. Installing the plugin alone does not create a connection.

So check the connection status in each site’s own WordPress dashboard. TeamUpdraft also asks customers to sign in to UpdraftCentral through My Account on teamupdraft.com and check any site listed there that they did not knowingly connect since 19 October.

What do the security updates remove?

Versions 1.26.13 and 2.26.13 revoke UpdraftCentral keys created before a cut-off on 18 October. They do not remove keys created later that day, or anything an attacker has already installed.

The WordPress.org changelog dates both 1.26.12 and 1.26.13 to 19 October, and the entry for 1.26.13 reads “FIX: Properly apply the revocation in 1.26.12”. Nethemba reports that 1.26.12 and 2.26.12 deleted no keys at all because of a bug.

TeamUpdraft states that 1.26.13 and 2.26.13 disconnect every UpdraftCentral connection made before 13:07 BST on 18 October, which is 12:07 UTC. Nethemba reports that keys created between 12:07 and 21:00 UTC that day stay on the site and have to be deleted by hand. TeamUpdraft’s notice gives the 13:07 BST cut-off but does not address that later window.

Deleting every key on a site stops further commands through UpdraftCentral, but a backdoor plugin or account added before then stays until someone removes it. Patchstack found that the backdoor accounts outlive the plugin that created them. It also notes that scheduled backups carry on after the keys are deleted, because only remote management stops. UpdraftVault is the exception: TeamUpdraft has disconnected every site from it, so backups will not reach the vault until you reconnect it (step 6).

What should you check on each website?

Check the plugin version, the connection keys, users, plugins, the access log and passwords, then investigate anything suspicious before reconnecting. TeamUpdraft’s incident instructions are the recovery reference.

If you suspect a site has been compromised, bring in your host or whoever handles incident response before cleaning up, so that the evidence is kept.

1. Sign in directly to WordPress and check the version. Use the site’s own dashboard, not UpdraftCentral. Update to 1.26.13 (free) or 2.26.13 (Premium) or later, and do not stop at 1.26.12 or 2.26.12. If the site will not load, ask your host to check the version and the plugin files for you.
2. Delete the UpdraftCentral connection key by hand, even after updating. Go to Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral, open Manage existing keys and delete every key. If no key is listed, the site is not connected now, which says nothing about whether it was accessed earlier. Removing the site from the UpdraftCentral dashboard is not enough on its own, because the key that matters lives on the site.
3. Inspect users, Editors included. Patchstack reports backdoor accounts that show as Editors but carry the capabilities to change settings and install plugins, so a review of administrators alone misses them. The usernames it confirmed follow a pattern of two words and two digits, such as data-ops43 and media-staff96.
4. Inspect plugins, including the Must-Use tab, and the files on the server. Nethemba found a variant called “Site Health Cache” that hides itself from the plugin list. Patchstack saw 99 plugin names, and every sample in its set carried the description “Small maintenance toolkit: keeps option storage tidy.” Nethemba’s samples used other descriptions, so a match is a warning sign and no match proves nothing. Ask your developer or host to look for any plugin folder nobody recognises. If you find one, do not delete it from the WordPress admin yet (see below).
5. Check the server’s access log. Nethemba found a variant that logs the attacker in as an existing administrator and creates no account. An unchanged user list cannot rule it out, so have your host inspect the plugin files and the access logs. UpdraftPlus keeps only the last 50 events in its own UpdraftCentral log, so older activity may only be in the server’s logs.
6. Change the relevant passwords. Change the teamupdraft.com password by going to the site directly rather than through an emailed link, change it anywhere else you used it, and, if you use two-factor authentication, reset it in My Account. Change every administrator password on the site and end all logged-in sessions. UpdraftVault users then reconnect the vault with the new password and run a manual backup to confirm it works. If the site was accessed through UpdraftCentral, TeamUpdraft also advises re-authorising remote backup storage and changing any storage access keys.
7. Investigate anything suspicious before reconnecting. If you find signs of compromise, TeamUpdraft suggests restoring from a backup taken before 17 October. Before you restore, ask your host to keep a copy of the current files, database and logs, and once the site is clean, change the passwords again, as WordPress’s own recovery guide advises. TeamUpdraft says a site can be reconnected to UpdraftCentral after these steps; Patchstack advises waiting until the vendor explains the cause. Staying disconnected does not stop your scheduled backups.

Nethemba advises deactivating a suspicious plugin and moving its folder out of the publicly served part of the server (your host can do this) rather than deleting it from the WordPress admin, because the samples’ uninstall routine wipes their own settings from the database. Patchstack adds one warning: some samples throw server errors because of a coding mistake, and fixing that mistake switches the backdoor on, so remove such a plugin rather than repair it.

What else should Premium users know?

Nethemba also reports that UpdraftPlus Premium stores the teamupdraft.com account password in the WordPress database, exactly as entered, in the option updraftplus-addons_options. Nethemba reports that TeamUpdraft says the password is removed after the first connection; Nethemba’s own reading of the code is that the password goes only after add-ons are claimed, and it cites a reader who found it on all three of their Premium sites, in backups going back to 2022. Nethemba gives a command to remove the stored password, which plugin updates do not need, and then advises changing the account password; ask your developer to run it.

This concerns storage on the customer’s own site. TeamUpdraft’s statement that passwords in its customer database were stored hashed refers to a different place. If a site may have been accessed, treat that account password as exposed and change it.

What should agencies record?

For every installation you manage, record the version, the connection status and the outcome of the inspection. Keep the update and the inspection as separate entries, because an updated site can still be compromised. If you are already working through the PHP2Shell patching we covered on 21 October, add these checks to the same site list.

If you want help checking a set of WordPress sites, talk to AIWIZ.