TeamUpdraft breach exposes keys used to backdoor WordPress sites
The maker of the UpdraftPlus backup plugin says the intrusion is contained, but remote-management keys taken from its systems were used to plant hidden plugins on customers’ websites before they were revoked
- Data the company believes was accessed: names, email and billing addresses, order history, hashed passwords, two-factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone
- No card details were held; payments run through Stripe and PayPal, TeamUpdraft says
- Patchstack logged 99 distinct backdoor plugin names
- TeamUpdraft has disconnected every site from UpdraftVault and replaced every UpdraftClone client key
Exposure sits with sites that held an UpdraftCentral cloud key, and Patchstack says that includes sites enrolled through a default-ticked box when a teamupdraft.com account is linked, whose owners may never have chosen remote management. Revoking keys stops new commands but does not undo earlier ones: Patchstack says the hidden account stays in WordPress after the backdoor plugin is removed. The steps TeamUpdraft sets out for UpdraftCentral cloud users run from logging in to each site directly and removing unfamiliar administrators and plugins to a restore from an earlier backup where anything looks suspicious. Free UpdraftPlus users without a teamupdraft.com account need take no action, the company says.
“To be clear – the unauthorised access was resolved and an update to UpdraftPlus (1.26.13 and 2.26.13) published just after 10pm BST on the 19th revoked UpdraftCentral connection keys thus blocking any access across that vector.”Joe Whittaker, head of product, marketing and support, TeamUpdraft
Newport-registered TeamUpdraft, which makes the UpdraftPlus backup plugin, said on 19 October that it had found unauthorized access to its website over the weekend of 17–18 October and believes its customer database was accessed. Attackers then used UpdraftCentral connection keys, which that database held, to install backdoor plugins on connected customer websites across an 18-hour window on 18–19 October, according to Patchstack, a WordPress security vendor.
TeamUpdraft says its plugins run on more than 5 million WordPress websites. UpdraftCentral lets agencies and site owners manage many sites from one dashboard, and the connecting code is built into UpdraftPlus itself. A connected site runs any command signed with a valid key, so the attacker’s uploads passed every check. Patchstack says the backdoor creates an account that shows the lower-level editor role but can install plugins and change settings, and that it logs in by setting a cookie, which skips two-factor authentication. It also found keys issued in November 2025 still working in October 2026.
BleepingComputer estimates that about 10% of UpdraftPlus sites hold an UpdraftCentral or Migrator key, or around 400,000 websites. As reported by BleepingComputer, Nethemba, a web application security firm that found the attack on its own sites, said the first fix, versions 1.26.12 and 2.26.12, failed to remove the cloud keys because of a bug.
TeamUpdraft says the plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The company’s notice, posted by Joe Whittaker, head of product, marketing and support, was updated on 20 October to answer reports elsewhere that the attack was continuing.
Sources
- TeamUpdraft, “TeamUpdraft security incident: What customers need to know”, company blog, 19 October 2026 (updated 20 October 2026). https://teamupdraft.com/blog/security-incident-october-2026/
- Patchstack, “Stolen UpdraftCentral Keys Are Backdooring WordPress Sites”, security advisory, 19 October 2026. https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/
- BleepingComputer, “Stolen UpdraftCentral keys used to backdoor WordPress sites”, Bill Toulas, 20 October 2026. https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/
