Overview
TeamUpdraft, the developer of the UpdraftPlus WordPress backup plugin, disclosed that an attacker gained unauthorized access to its website over the weekend of October 17–18, 2026. The company believes the attacker reached a customer database that held UpdraftCentral connection keys. Those keys let a remote dashboard send commands to connected WordPress sites, and attackers are now using stolen ones to take over sites.
What Was Exposed
TeamUpdraft says the affected database contained:
- Names, email addresses, billing addresses and order history
- Password hashes and two-factor settings
- Connection keys for UpdraftCentral, UpdraftVault and UpdraftClone
The company says it did not store payment card details. It has reported the incident to the UK Information Commissioner's Office.
How the Attacks Work
According to Patchstack, attacks began on October 18 at 15:32 UTC. No plugin vulnerability is required: a valid key is enough for the attacker to:
- Run arbitrary code on the connected site
- Install backdoor plugins
- Create full administrator accounts
UpdraftPlus has more than 4 million active installations, and the UpdraftCentral client ships with every copy. The "Add this website to UpdraftCentral" checkbox is ticked by default, so some owners may be enrolled without realizing it. One estimate puts potential exposure near 400,000 sites. That figure is potential exposure, not a confirmed victim count.
Security firm Nethemba published the first detailed analysis after unknown plugins were pushed to two of its own sites.
Fix Status and Gaps
- An initial patch meant to remove UpdraftCentral Cloud keys was incomplete because of a bug.
- UpdraftPlus 1.26.13 / 2.26.13 and later address the issue.
- Some keys still need manual removal, and updating does not remove a backdoor that is already installed.
- TeamUpdraft has not said how the attacker got in, only that it deployed a fix for the underlying weakness.
Recommended Actions
- Update UpdraftPlus to the latest release.
- Delete or rotate all UpdraftCentral keys before removing any backdoor plugin. Otherwise the attacker can push a replacement.
- Review installed plugins, files and administrator accounts for anything unexpected.
- Deactivate a suspicious plugin and move it out of the web root rather than uninstalling it from wp-admin, because its uninstall routine may erase its own traces.
- Rotate remote-storage credentials and reauthorize connections, as TeamUpdraft recommends.
- Reset your TeamUpdraft account password.
Takeaway
This is a vendor-side compromise: the sites themselves were not vulnerable. Remote-management keys are effectively admin credentials, so treat them like any other privileged secret, and remove the connection from sites that don't need it.