Stolen UpdraftPlus keys let attackers plant backdoors

On 19 October 2026 TeamUpdraft, the company behind the UpdraftPlus backup plugin, disclosed unauthorised access to teamupdraft.com over the weekend of 17 and 18 October. The stolen data includes the keys for UpdraftCentral, the service that lets you manage many sites from one place. With those keys the attacker sends commands to sites and installs a plugin carrying a backdoor. On the evening of 19 October TeamUpdraft released versions 1.26.13 (free) and 2.26.13 (Premium), which revoke the old keys. According to wordpress.org, UpdraftPlus has more than 3 million active installations.

The update does not remove every key, though, and it does nothing for a site that has already been hit. If the backdoor was installed, the site now has a user account that stays even after the plugin is deleted.

What leaked from TeamUpdraft

TeamUpdraft says the attacker reached its customer database, with names, email addresses, billing addresses, order history, hashed passwords, two-factor settings and the keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company does not store card details. The plugin and its downloads were not affected.

According to Patchstack, the attacker sends the site a plugin.upload_plugin command signed with a genuine key, so UpdraftPlus accepts it and WordPress installs and activates the plugin. Patchstack recorded such installations on 18 and 19 October under 99 different names, some of them with a description that begins "Small maintenance toolkit". It lists the campaign as ongoing. There is no CVE, because the plugin's code has no vulnerability.

What the backdoor does on the site

The plugin waits for a request with a secret parameter in the address. When it gets one, it creates a user with the Editor role and grants it the capabilities to install plugins and change settings. With those the account can make itself an administrator, yet it does not show up in the list of administrators. Nethemba also found accounts created as administrators outright.

To log in, the plugin sets the login cookie itself and redirects to wp-admin. That skips the login form, and with it two-factor authentication and any limit on login attempts. The account survives the removal of the plugin, and the attacker knows its password.

UpdraftCentral keys do not expire. On 20 October Nethemba saw the attacker trying the secret addresses of backdoors that had already been removed. Wherever a backdoor is still in place, the attacker can walk in.

Why a site that never used UpdraftCentral can be at risk

When you connect the plugin to your TeamUpdraft.com account, for Premium updates or for UpdraftVault, say, the form has a checkbox labelled "Add this website to UpdraftCentral". If the site has no key yet, the box is ticked by default, as the code of version 1.26.13 shows. One login with the box left ticked is enough to create a key. Installing the plugin alone does not create one.

Removing the site from the UpdraftCentral dashboard does not help, because the key is stored on the site itself and stays there.

Is your site affected?

You can see the UpdraftPlus version under Plugins > Installed Plugins. In cPanel's Terminal, the first command below shows the version and the second checks whether the site holds an UpdraftCentral key. The WP-CLI guide explains how to work with WP-CLI.

# cPanel > Terminal, in the site's folder
# Read-only. The UpdraftPlus version and the UpdraftCentral keys.
wp plugin list --fields=name,status,version \
  --skip-plugins --skip-themes | grep -i updraft
wp option get updraft_central_localkeys \
  --skip-plugins --skip-themes

If the second command answers "Could not get 'updraft_central_localkeys' option" or prints an empty list, there is no key. If it prints entries, there is a key and the site needs checking. With --skip-plugins --skip-themes WP-CLI skips the plugins and the theme and does not run a backdoor's code (must-use plugins still load).

The next commands look for traces of the attack and change nothing either.

# cPanel > Terminal, in the site's folder
# Read-only. Who can install plugins, the newest users,
# the plugins and their most recently changed folders.
wp user list --capability=install_plugins \
  --fields=ID,user_login,user_email,roles,user_registered \
  --skip-plugins --skip-themes
wp user list --orderby=registered --order=DESC --number=20 \
  --fields=ID,user_login,user_email,roles,user_registered \
  --skip-plugins --skip-themes
wp plugin list --fields=name,title,status,version \
  --skip-plugins --skip-themes
ls -lt wp-content/plugins | head -n 15

The first command lists everyone who can install plugins. A user with the editor role or an administrator you do not recognise in that list is a strong sign of the backdoor. The second shows the 20 most recently registered users. The attack's accounts have names such as data-ops43 and email addresses at @example.org or @example.com. The last two list the plugins (including those in mu-plugins) and their folders, most recently changed first. Look for unfamiliar names such as site-health-cache and folders changed since 18 October.

What to do

1. Update UpdraftPlus to 1.26.13 or later (Premium to 2.26.13). Version 1.26.12 was meant to revoke the old keys, but a bug stopped it. According to its code, 1.26.13 deletes only the keys created before 12:07 UTC on 18 October. Newer keys stay, which is why the next step matters.
2. Delete every UpdraftCentral key. In wp-admin you do it under Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral, in "Manage existing keys", and with WP-CLI using the command below. Backups keep running, only remote management stops. Patchstack advises against reconnecting the site until TeamUpdraft explains how the keys leaked.

# cPanel > Terminal, in the site's folder
# Changes the database. Deletes all UpdraftCentral keys.
wp option delete updraft_central_localkeys \
  --skip-plugins --skip-themes

A deleted key cannot be brought back. Reconnecting to UpdraftCentral creates a new one.

3. Change your teamupdraft.com password, typing the address yourself. If you use the same password anywhere else, change it there too. If you use two-factor authentication, reset it from My Account. TeamUpdraft has disconnected every site from UpdraftVault, so if you use it, reconnect your sites with the new password.
4. If the checks turn up an unfamiliar user or plugin, treat the site as hacked. Delete the key first, or the attacker can push a new backdoor. Do not delete the plugin through wp-admin, because Patchstack found that deleting it wipes its own traces. Deactivate it, move its folder out of the site, delete the account, change the administrators' passwords and end all active sessions. TeamUpdraft recommends restoring from a backup taken before 17 October if anything looks suspicious. The backup guide explains how to restore one.

What we do

With vulnerability (CVE) monitoring we match the plugins, theme and WordPress on your site against the vulnerability (CVE) databases every day. As soon as a vulnerability appears in something you use, we send you an alert, and we try the update on a copy in staging first. The UpdraftPlus incident has no CVE, so the checks above are what catches it. If they show signs of the attack, with hacked site cleanup we remove the backdoor and the hidden accounts. We do both for your site wherever it is hosted.

Sources

• TeamUpdraft, Security incident October 2026
• WordPress.org, UpdraftPlus
• WordPress.org Plugin SVN, UpdraftPlus 1.26.13, admin.php
• WordPress.org Plugin SVN, UpdraftPlus 1.26.13, class-updraftplus.php
• Patchstack, Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
• Nethemba, Critical security problem in UpdraftCentral, analysis of the backdoor
• WP-CLI, wp option get
• WP-CLI, wp option delete
• WP-CLI, wp user list
• WP-CLI, wp plugin list
• WordPress Developer Resources, WP_User_Query