October 19, 2026: TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin, disclosed unauthorized access to teamupdraft.com and said it believes its customer database was accessed. That database held the connection keys for UpdraftCentral, its cloud tool for managing many WordPress sites at once, and the attacker used those keys to install backdoor plugins on customers' sites. Canonical: teamupdraft-updraftcentral2026. Primary source: TeamUpdraft's security advisory.
UpdraftPlus is one of the most widely used WordPress plugins, with more than 4 million downloads. Most users only use it for backups, but agencies and freelancers often connect their sites to UpdraftCentral so they can update, back up and administer dozens of client sites from one dashboard. To make that work, each connected site trusts commands signed with a connection key. Steal the keys and you can talk to every connected site as if you were its administrator. That is what happened here.
What happened
- October 17–18: TeamUpdraft identified unauthorized access to teamupdraft.com over the weekend. It says it "responded straight away and worked through the night to contain it", closed the access route, signed every account out and replaced keys and credentials.
- October 18, 15:32 UTC: WordPress security firm Patchstack says the first backdoor installs began, delivered through UpdraftCentral's remote-management channel using valid keys.
- October 19: TeamUpdraft published its advisory. Just after 22:00 BST it released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which disconnect older UpdraftCentral connections.
- October 20: TeamUpdraft updated the advisory to say the unauthorized access was resolved and that reports of an ongoing attack were inaccurate, while still telling customers to check their sites.
TeamUpdraft has not said how the attacker got into teamupdraft.com.
Technical analysis
From a vendor database to customer sites
The attacker did not need a vulnerability in WordPress or in the UpdraftPlus plugin. UpdraftCentral is designed to let a key holder run administrative actions on connected sites, so commands signed with stolen keys looked legitimate to the sites receiving them. The attacker used that channel to upload plugins.
The backdoors
Patchstack logged at least 99 malicious plugins with different names, disguised as maintenance or optimisation tools such as "Site Health Cache". Patchstack says they execute arbitrary code and create accounts with full administrator rights; an early variant was broken by a coding error. Security firm Nethemba, which saw three of its own sites targeted and two infected, says a newer version lets the attacker create privileged accounts or log in as an existing administrator. Because the backdoors are separate plugins, removing the UpdraftCentral key does not remove them.
A fix that needed a second attempt
Nethemba reports that release 1.26.12/2.26.12 was meant to remove the UpdraftCentral cloud keys but a bug stopped it from doing so. Version 1.26.13/2.26.13 is the one that disconnects older connections. TeamUpdraft's own instructions still mention 1.26.12/2.26.12 in places, so update to 1.26.13/2.26.13 or later to be safe.
Impact
- TeamUpdraft account holders: names, email and billing addresses, order history, hashed passwords and two-factor settings are believed to have been accessed. Card details are not stored, since payments go through Stripe and PayPal.
- Sites connected to cloud UpdraftCentral: exposed to backdoor installs. About 10% of UpdraftPlus sites have an UpdraftCentral or Migrator key, which BleepingComputer puts at roughly 400,000 sites potentially exposed. How many were actually backdoored is not known.
- UpdraftVault and UpdraftClone users: their connection keys were in the same database. TeamUpdraft disconnected all sites from UpdraftVault, issued new credentials, and replaced every UpdraftClone key.
- Not affected: the UpdraftPlus plugin files and downloads, backups stored in your own Google Drive, Dropbox or Amazon S3, and self-hosted UpdraftCentral.
A backdoored WordPress site gives the attacker the site's database, its users, and a place to host phishing or malware. Agency-managed sites are the main concern, because one stolen agency key can reach every client site it manages.
Verified vs unverified
- Verified (TeamUpdraft): unauthorized access to teamupdraft.com on October 17–18, the data held in the customer database, the keys rotated, and the fixed releases.
- Company belief, not certainty: that the customer database itself was accessed.
- Researchers (Patchstack, Nethemba): the start time of the backdoor wave, the 99-plus plugin variants, and what the backdoors do.
- Unknown: how teamupdraft.com was breached, how many customers' data was taken, and how many sites were backdoored.
What to do
- Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later on every site.
- Delete UpdraftCentral connection keys on each site: Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys. Log in to each site directly, not through UpdraftCentral.
- Look for the backdoor: remove administrator accounts you do not recognise and plugins you did not install, including must-use plugins. Compare against the indicators published by Patchstack and Nethemba.
- If a site was compromised, restore it from a backup taken before October 17, then change all WordPress administrator passwords and database credentials.
- Change your teamupdraft.com password by typing the address yourself rather than following an email link, change it anywhere you reused it, and reset your two-factor setup in My Account.
- Re-authorise remote storage and change the storage keys used by UpdraftPlus, reconnect UpdraftVault with your new credentials and run a manual backup, and send clients new UpdraftClone keys if you shared them.
- Be wary of emails about this incident. Attackers who hold customer names and order histories can write convincing phishing.
Related incidents
This is the second WordPress plugin vendor compromise in a week. Rank Math PRO shipped a backdoored release through its own update servers (our write-up). Both cases abused a trusted vendor channel rather than a bug on the sites themselves, much like the OVHcloud CLI release hijack (our write-up).
Sources
TeamUpdraft advisory • BleepingComputer • Patchstack • Nethemba