Last weekend someone broke into TeamUpdraft, the company behind the UpdraftPlus backup plugin, and used what they found to quietly install backdoors on WordPress websites. UpdraftPlus has more than 3 million active installs, according to WordPress.org, so there’s a fair chance it’s on your site.
Most sites weren’t touched, and the plugin’s code wasn’t the problem. But a site that was hit won’t necessarily look hacked, and the automatic update that went out on Monday night doesn’t clean anything up. Here’s what happened, how to tell whether it affects you, and what to check.
What happened at UpdraftPlus
According to TeamUpdraft’s own incident report, it found unauthorised access to the teamupdraft.com website over the weekend of 17 to 18 October 2026. It believes the customer database was accessed. That database holds names, email addresses, billing addresses, order history, hashed passwords and the connection keys for three of its services: UpdraftCentral, UpdraftVault and UpdraftClone. Card details weren’t stored there, because payments go through Stripe and PayPal.
The connection keys are what mattered. UpdraftCentral is a remote management dashboard that lets you run backups, update plugins and install new ones across lots of sites from one place. Each connected site trusts a key. Whoever holds that key can send the site instructions, and the site will carry them out without asking for a username or password.
The attacker had the keys, so their instructions looked genuine. Security firm Patchstack, which published a detailed analysis, saw the first backdoor go in at 15:32 on 18 October and says the campaign then ran continuously for around 18 hours. Patchstack is clear that “this is not a vulnerability in UpdraftPlus”. The plugin did exactly what it was designed to do. It just did it for the wrong person.
Is your WordPress site affected?
Only sites with an UpdraftCentral cloud connection were at risk, not every site running UpdraftPlus. TeamUpdraft says free users who’ve never had a teamupdraft.com account don’t need to take any action. People running their own self-hosted copy of UpdraftCentral weren’t affected either.
The catch is that you can have an UpdraftCentral connection without knowing it. Patchstack found that when you link a site to a TeamUpdraft account (which you’d do to activate Premium or UpdraftVault, for example), the box that says “Add this website to UpdraftCentral” is ticked by default. Plenty of people will have clicked straight past it. The keys don’t expire, either: Patchstack saw keys issued in November 2025 still working this month.
So you need to look more closely if any of these apply to you:
- You use UpdraftPlus Premium
- You store backups in UpdraftVault
- You’ve ever logged into a teamupdraft.com account from your site’s dashboard
- A developer or agency manages your site through UpdraftCentral
What the attackers did to WordPress sites
The attacker used the stolen keys to tell sites to install a plugin, which WordPress then installed and switched on through its normal process. The plugins had harmless-sounding names (Patchstack counted 99 different ones, with “Site Health Cache” the most common), and the description read “Small maintenance toolkit: keeps option storage tidy.”
The plugin creates a new user account with the Editor role, which normally can’t change settings or install anything. Then it quietly gives that account extra permissions to do both, which is effectively admin access. So a quick look at your list of administrators won’t show it. It also logs in by setting a login cookie directly, which means two-factor authentication and login-attempt limits never get a look in. And the account stays put even after the plugin is removed.
There’s one odd detail. Patchstack found a coding error in the backdoor that makes affected sites throw a server error (an “HTTP 500” or blank error page) on some requests. If your site has had unexplained errors since 18 October, take that seriously. Patchstack’s advice is not to repair the faulty plugin, because fixing the error switches the backdoor on. It has to come out.
What the automatic update does, and what it doesn’t
TeamUpdraft released UpdraftPlus 1.26.12 and then 1.26.13 (free) and 2.26.13 (Premium) on 19 October, and WordPress.org pushed them out automatically. The changelog says the update “revokes UpdraftCentral Cloud keys created before the incident”, and 1.26.13 fixed a problem with how 1.26.12 applied that.
That closes the door. It doesn’t check whether anyone came in while it was open. If a backdoor plugin or a rogue account was added to your site on 18 or 19 October, it’s still there after the update.
There’s a knock-on effect too. TeamUpdraft disconnected every site from UpdraftVault and issued new credentials, and says backups won’t reach Vault until you reconnect. If you rely on Vault, your backups may have stopped this week without you noticing. UpdraftClone keys have also been replaced.
What to check on your site now
If any of the situations above apply to you, this is the list I’d work through today:
- Check the version. On your Plugins page, UpdraftPlus should be 1.26.13 or later (free) or 2.26.13 or later (Premium).
- Delete any UpdraftCentral keys. Go to Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral and remove any existing keys. Your backups will carry on working. Removing a site from the UpdraftCentral dashboard doesn’t remove the key from the site itself.
- Check every user, not just administrators. Look for Editors you don’t recognise. The known pattern is two words plus two digits (Patchstack’s examples are data-ops43 and media-staff96), an email address ending @example.org, and a display name of “Site Tools”.
- Check your plugins. Look for anything you didn’t install, particularly “Site Health Cache” or that “Small maintenance toolkit” description. If you see a “Must-Use” tab on the Plugins page, check that too.
- Change your passwords. Change the passwords for all admin accounts and for your teamupdraft.com account. Type teamupdraft.com into your browser rather than clicking a link in an email: the email addresses were in the stolen data, so expect convincing phishing. Turn on two-factor authentication while you’re there.
- Check your backups are running. If you use UpdraftVault, reconnect it, run a backup and make sure it actually finishes.
- Refresh your storage keys if you need to. TeamUpdraft says that if your site was accessed through UpdraftCentral, you should also re-authorise your remote backup storage (Dropbox, Google Drive and so on) and change its access keys.
If you find something
Treat the site as fully compromised. Deleting the rogue user and plugin isn’t enough on its own. Patchstack’s advice is to remove the UpdraftCentral key first, then take the plugin out by moving it off the server rather than deleting it from the dashboard. After that, restore from a clean backup, change every password and log everyone out. TeamUpdraft suggests a backup from before 17 October. If that list sounds daunting, it’s a job for whoever manages your hosting, not a Sunday afternoon project.
Should you stop using UpdraftPlus?
The plugin’s code wasn’t at fault, and TeamUpdraft says the plugin and its downloads weren’t tampered with. Uninstalling it in a panic and leaving yourself with no backups would be the worse outcome.
The real lesson is broader than one plugin. Every time you click “connect your site to our dashboard”, you’re handing someone a key to your website. Most of the time that’s fine. But if a company holding thousands of those keys gets broken into, the attacker gets thousands of keys. So keep the connections you actually use and remove the rest.
The other lesson is about backups. “Restore from a backup made before the 17th” is good advice, but it only helps if you have one, it’s stored somewhere other than the site itself, and it actually restores. A backup you’ve never tested is really just a hope.
Let me look after this for you
Most business owners don’t want to spend their week reading security advisories and digging through user lists, and they shouldn’t have to. My WordPress Support & Hosting packages (from £89+VAT a month) include hosting on my own managed servers, daily backups stored off-site, WordPress, theme and plugin updates, and support hours each month. When something like this comes along, and there’s always a next one, you can leave it to me.
There’s no call to book. Order online and I’ll get started.
Peter Mahoney
WordPress SEO & AI Search (GEO) Expert