On October 18 and 19, 2026, an attacker installed malicious plugins on WordPress sites running UpdraftPlus, a backup plugin with more than 3 million active installations according to the WordPress.org directory. The attacker used UpdraftCentral connection keys stolen from the plugin’s publisher, TeamUpdraft, whose website, teamupdraft.com, was breached over the weekend of October 17 and 18.
The story isn’t over. On October 21, TeamUpdraft asked Premium customers to check their sites “even if you’ve never used UpdraftCentral.” The same day, Nethemba, the security firm that discovered the attack on its own sites, received new commands from the attacker, sent after the update meant to block them. Nethemba also reports that the Premium edition can store the teamupdraft.com account password in plain text.
The breach at TeamUpdraft
In its incident notice of October 19, TeamUpdraft wrote: “We believe our customer database was accessed.” That database held names, email and billing addresses, order history, hashed passwords, two-factor authentication settings and connection keys for three of the company’s services: UpdraftCentral, UpdraftVault and UpdraftClone.
The company says the database held no card details, and that the plugin, its downloads, backups sent to Google Drive, Dropbox or Amazon S3, and self-hosted UpdraftCentral installations were not affected. TeamUpdraft reported the incident to the ICO, Britain’s data protection regulator. On October 21, it added that the attacker got in using “a compromised key,” that an outside cybersecurity firm was helping and that the police had been contacted.
Signed commands, run without confirmation
UpdraftCentral lets site owners manage several WordPress sites from one dashboard. Its client module ships in every copy of UpdraftPlus, free or paid, and stays inactive until the site has a key. Once a key exists, the site runs any command signed with the dashboard’s private key, without asking for confirmation. For the cloud service, TeamUpdraft holds those private keys.
Patchstack’s October 19 analysis found that the attacker had the plugins installed through WordPress’s standard installer. The Estonian security firm counted 99 differently named malicious plugins, installed between the afternoon of October 18 and the morning of October 19. Patchstack lists the case as a key compromise with no CVE: the commands were validly signed, so they passed every check in the plugin.
A key could exist without the owner knowing. When the plugin is linked to a teamupdraft.com account, an “Add this website to UpdraftCentral” checkbox is checked by default, Patchstack and Nethemba note. Patchstack adds that the keys don’t expire: some issued in November 2025 still worked in October 2026.
IT-Connect went down three seconds after the install
Florian Burnel, cofounder of the French site IT-Connect, described the attack in detail on October 19. At 7:17:34 a.m. Paris time, the UpdraftCentral log recorded a plugin install command. A plugin called “Type Stack 285” was created and activated; three seconds later, the whole site was returning 500 errors.
The site’s UpdraftCentral key dated back to January 2020. The plugin was meant to create an inconspicuous account, displayed as “Site Tools,” with WordPress’s Editor role plus administrator rights. A bug crashed it before it could run, and Burnel brought the site back by moving the plugin’s folder out of the plugins directory.
The 500 errors gave the first infections away
The samples Patchstack analyzed threw a fatal error before they even read the secret token, so the sites returned a 500 error on every request not served from cache. Patchstack and Nethemba warn against repairing such a plugin, because fixing the error switches the backdoor on.
Other variants worked. According to Nethemba, one logs the attacker in as an existing administrator and leaves no trace in the database; another, “Site Health Cache,” hides itself from the plugin list. On two sites belonging to one administrator, backdoors ran for more than three hours before the broken variant took the site down.
A long outage also hurts search visibility. Google’s documentation says that “5xx and 429 server errors prompt Google’s crawlers to temporarily slow down with crawling,” and that URLs already in the index are “eventually dropped” if the errors persist. On October 21, during the PHP2Shell emergency, Google advised sites to serve a 503 during planned downtime. The owners of the compromised sites had no such choice.
Two fixes later, some keys remain
On October 19, TeamUpdraft released version 1.26.12 (2.26.12 for Premium) to revoke UpdraftCentral keys created before the incident. Nethemba found that, because of a bug, it deleted no keys at all. Version 1.26.13 (2.26.13), released the same evening, applies the revocation correctly, according to its changelog. TeamUpdraft says WordPress.org pushed it automatically to all users.
Version 1.26.13 deletes every key created up to 1:07 p.m. BST (12:07 p.m. UTC) on October 18. Nethemba points out that keys created that day between 1:07 p.m. and 10 p.m. BST (12:07 p.m. and 9 p.m. UTC) stay in place, even though the company had first announced 10 p.m. as the cutoff. Revocation doesn’t remove anything already installed either: TeamUpdraft asks users to look for unknown accounts and plugins, must-use plugins included, and to change administrator passwords.
New commands and a plain-text password
On October 20, TeamUpdraft said the unauthorized access was “resolved” and pushed back on reports of an ongoing attack. The next morning, between 7:10 and 9:21 a.m. UTC, Nethemba received new commands from the attacker on two of its sites. They failed because the firm had already deleted the keys and blocked that type of command.
On October 22, TeamUpdraft said it was “seeing a pattern of unexpected ‘editor’ roles.” Since that day, Nethemba has been documenting the password problem: the Premium edition stores the teamupdraft.com account password exactly as it is typed, in the updraftplus-addons_options database option, so it can also end up in backups. One of Nethemba’s readers found it on all three of their Premium sites and in backups going back to 2022.
TeamUpdraft’s claims and the evidence
TeamUpdraft says there is “no evidence” the attacker still has access to its website. The October 21 commands show that the attacker still holds keys and keeps using them. According to Nethemba, a stolen key stays usable on a site until it is deleted from that site, no matter what happens on the company’s servers.
On the password, Nethemba reports that the company says it is removed after the first connection. Nethemba’s reading of the code is that it is deleted only after a successful token login, and “in practice it often stays for good.” On October 21, TeamUpdraft also wrote, without offering further evidence, that the speed of the attacks and the initially faulty plugins “suggest that the hackers used AI to accelerate their attack.”
Neither TeamUpdraft nor Nethemba knows how many sites were hit. After a flaw in the same channel in June, TeamUpdraft estimated that fewer than 10% of users held an UpdraftCentral or Migrator key. Nethemba translates that into up to about 400,000 sites, based on the more than 4 million installations it attributes to WordPress.org (the directory now shows “3+ million”).
What it means
UpdraftPlus’s remote management channel, present in every copy, opened the door to anyone holding the keys. The most exposed sites are those ever linked to a teamupdraft.com account, especially Premium sites, and those managed from the UpdraftCentral cloud dashboard. Nethemba notes that a site never linked to an account or to UpdraftCentral has no key.
The first malicious installs came two days after another incident ended: on October 15 and 16, official Rank Math PRO updates carried a backdoor. Both attacks used a mechanism each vendor built itself: the update download at Rank Math, the UpdraftCentral channel and its keys at UpdraftPlus. The owners of the affected sites hadn’t installed anything unusual.
Three questions remain open: how the attacker obtained the “compromised key” used to break into the company’s website, how many sites were actually compromised, and what happens to the two gaps Nethemba flagged (the keys version 1.26.13 leaves in place and the password kept in the database). The next UpdraftPlus release and further updates to TeamUpdraft’s notice will show whether the company closes them.
Sources
- TeamUpdraft security incident: What customers need to know, TeamUpdraft, October 19, 2026, updated October 23, 2026
- Stolen UpdraftCentral Keys Are Backdooring WordPress Sites, Patchstack, October 19, 2026
- Critical security problem in UpdraftCentral: an attacker holding the service’s keys planted a backdoor on our websites, Nethemba, October 19, 2026, updated October 23, 2026
- UpdraftPlus : comment une porte dérobée a été installée sur IT-Connect via UpdraftCentral, IT-Connect, October 19, 2026
- UpdraftPlus: WP Backup & Migration Plugin, WordPress.org, accessed October 24, 2026
- How HTTP status codes affect Google’s crawlers, Google, accessed October 24, 2026
Header image: MACCUS chart. Data: TeamUpdraft, Patchstack, Nethemba, IT-Connect and WordPress.org, October 2026
