UpdraftCentral Security Incident: How to Check and Protect Your WordPress Site

If your WordPress sites run UpdraftPlus and you have ever connected them to a teamupdraft.com account or to UpdraftCentral, this guide explains what has been reported about the October 2026 security incident at TeamUpdraft and how to check and protect your sites, step by step.

Fact check: 20 October 2026. The situation is still developing and TeamUpdraft says it will update its own notice as the investigation continues. Where sources disagree or a point is not confirmed by the vendor, we say so.

What happened

According to TeamUpdraft’s security notice, there was unauthorised access to teamupdraft.com over the weekend of 17 and 18 October 2026. The notice was published on 19 October and was last updated at 19:03 BST that day when we checked it.

  • 17 and 18 October: unauthorised access to teamupdraft.com. TeamUpdraft believes its customer database was accessed.
  • 18 October: first backdoor installation seen in Patchstack’s telemetry. Patchstack later counted 99 different names for the malicious plugin.
  • 19 October: the security company Nethemba detected the attack on its own sites and published an analysis. TeamUpdraft published its notice.
  • 19 October: UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium) were released to revoke UpdraftCentral Cloud keys created before the incident. Version 1.26.13 followed the same day to “properly apply the revocation”, according to the changelog on WordPress.org.

What data is affected

TeamUpdraft says the customer database holds names, email addresses, billing addresses, order history, hashed passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card details are not stored, because payments are handled by Stripe and PayPal.

According to the vendor, these are not affected: the UpdraftPlus plugin and its downloads, backups sent to your own remote storage such as Google Drive, Dropbox or Amazon S3, and self-hosted UpdraftCentral.

Not confirmed at the time of writing: how many accounts are affected, and how the attacker got in. TeamUpdraft says it closed the access route and fixed the underlying weakness, but has not described the cause.

Who is affected

  • Everyone with a teamupdraft.com account: change your password and review 2FA.
  • Sites connected to UpdraftCentral Cloud: these are the sites at risk of a backdoor.
  • UpdraftVault and UpdraftClone users: TeamUpdraft has disconnected Vault sites and replaced all Clone client keys, so you need to reconnect.
  • Free UpdraftPlus users without a teamupdraft.com account: the vendor says no action is required beyond keeping the plugin updated.

Why updating alone is not enough

UpdraftCentral sends commands to connected sites. A site only accepts a command if it is signed with the dashboard’s private key. Patchstack and Nethemba both report that the attacker held genuine dashboard keys and sent validly signed plugin.upload_plugin commands, so the sites treated them as legitimate. This is not a coding flaw in the plugin, and there is no CVE for it.

Three details make this hard to spot:

  • Keys do not expire. Patchstack found keys from November 2025 still working.
  • Many sites hold a key without the owner knowing. When you connect a teamupdraft.com account in UpdraftPlus, an UpdraftCentral checkbox is ticked by default, which creates a key.
  • The backdoor survives the update. The new releases revoke old connections, but they do not remove a plugin or user account the attacker has already created. The backdoor logs in with a cookie, which bypasses the login form, two-factor authentication and login protection plugins.

Nethemba also reports that 1.26.13 may not remove keys created on 18 October between 12:07 and 21:00 UTC. TeamUpdraft has not confirmed this, but it is a good reason to delete keys manually.

Checklist for site owners

Run the WP-CLI commands from your WordPress root. The --skip-plugins --skip-themes flags stop a malicious plugin from loading and hiding itself while you check.

1. Disconnect UpdraftCentral and delete the keys

Log in to each site directly, not through UpdraftCentral. Update UpdraftPlus to 1.26.13 or 2.26.13 or later, then check whether a key exists:

wp plugin list --name=updraftplus --fields=name,version --skip-plugins --skip-themes
wp option get updraft_central_localkeys --skip-plugins --skip-themes

Any output from the second command means the site holds a key. Delete it under Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, or with:

wp option delete updraft_central_localkeys --skip-plugins --skip-themes

Removing the site from the UpdraftCentral dashboard alone is not enough. Patchstack notes that scheduled backups keep working after the key is deleted.

2. Check for unknown admin users

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --skip-plugins --skip-themes
wp user list --orderby=registered --order=DESC --number=20 --fields=ID,user_login,display_name,user_email,roles,user_registered --skip-plugins --skip-themes

The reported backdoor account is disguised as an Editor but has extra capabilities, so a role filter is not enough. This lists every user who can install plugins:

wp eval 'foreach (get_users() as $u) { if ($u->has_cap("install_plugins")) { echo $u->ID, " ", $u->user_login, " ", implode(",", $u->roles), PHP_EOL; } }' --skip-plugins --skip-themes

Reported signs: display name “Site Tools”, an @example.org email address, and usernames made of two words plus two digits, such as data-ops43.

3. Check for unknown plugins and mu-plugins

wp plugin list --fields=name,status,version,title --skip-plugins --skip-themes
wp plugin list --status=must-use --skip-plugins --skip-themes
grep -rl "Small maintenance toolkit" wp-content/plugins wp-content/mu-plugins
wp option list --search="*_sync_token" --skip-plugins --skip-themes

The description “Small maintenance toolkit: keeps option storage tidy.” is the most reliable indicator Patchstack reports. “Site Health Cache” is the most frequently reused name. Nethemba describes other variants with different descriptions, so treat any plugin you did not install as suspicious.

If you find one, do not repair it, even if it causes HTTP 500 errors: fixing the error can activate the backdoor. Delete the UpdraftCentral key first, then deactivate the plugin and move its folder out of the web root instead of deleting it in wp-admin, because its uninstall routine erases traces. Then remove the _sync_token option and the hidden account.

4. Review recently modified files and logs

find wp-content -type f -name "*.php" -newermt "2026-10-17" -ls
ls -la wp-content/upgrade/
wp core verify-checksums
wp plugin verify-checksums --all

Plugin checksums only work for plugins from WordPress.org. In your web server access log, look for POST / requests with the user agent class-udrpc.php and no WordPress version or URL, and for unfamiliar URL parameters with 32-character values. In the UpdraftCentral log, look for Command received: plugin.upload_plugin.

5. Change passwords

  • Change your teamupdraft.com password. Type the address yourself; do not follow a link from an email.
  • Change the same password anywhere else you reused it.
  • Change all administrator passwords and end all sessions. wp config shuffle-salts signs out every user at once.
  • If a site was accessed through UpdraftCentral, TeamUpdraft also advises re-authorising remote storage and changing storage access keys.

6. Check 2FA

Reset two-factor authentication in your teamupdraft.com account, as TeamUpdraft recommends. On your sites, confirm 2FA is still active for every administrator. Keep in mind that the backdoor bypasses 2FA, so 2FA does not replace steps 2 and 3.

7. Follow the vendor’s updates

Keep UpdraftPlus updated on every site, including sites you do not manage day to day, and check the TeamUpdraft notice for changes. TeamUpdraft lists reconnecting to UpdraftCentral as the final step; Patchstack advises waiting until the vendor explains the cause. If you need remote management sooner, both Patchstack and Nethemba suggest creating the key under a user without the install_plugins capability. UpdraftVault users need to reconnect each site and run a manual backup to confirm it works.

8. When to restore from a clean backup

If you find the backdoor account, or your access log shows a trigger request, treat the site as fully compromised. Restore from a backup taken before 17 October, compare files with a clean installation, review every user with elevated capabilities and change all passwords again. A backup taken after the compromise may contain the backdoor. A backup from before 17 October can still contain the old UpdraftCentral key, so run step 1 again right after the restore.

Make an independent backup before you clean up

Before you delete users, plugins or files, take a full backup of the site as it is now. It preserves evidence for your investigation and gives you a way back if a cleanup step breaks something; it is not a backup to restore as a clean state. You can create one with WP Staging Free and download it to your computer, so it does not depend on any third-party account. WP Staging Pro can restore a backup on another domain, which lets you inspect a copy of the site without touching the live one, and from the Business plan up it can also store backups off-site, for example on Google Drive, Amazon S3, Dropbox or SFTP.

Sources

Rene Hermenau

Author: Rene Hermenau

About the author: René Hermenau is the founder of WP STAGING. He works on WordPress backups, staging, migrations, database handling, and safe deployment workflows.