TeamUpdraft, maker of the UpdraftPlus backup plugin, confirmed on October 19, 2026 that someone broke into its website and probably took UpdraftCentral connection keys. Those keys were then used to install backdoored plugins on WordPress sites. Sites connected to cloud UpdraftCentral are the ones at risk. The release to install is 1.26.13 (free) or 2.26.13 (Premium).
What we know
- The breach: TeamUpdraft says it detected the access on October 18, over the weekend of October 17-18. It believes its customer database was accessed: names, emails, billing addresses, order history, hashed passwords, two-factor settings and the keys for UpdraftCentral, UpdraftVault and UpdraftClone. It says it does not store card details.
- Not affected: the plugin itself and its downloads, backups in each user's own storage (Google Drive, Dropbox, Amazon S3) and self-hosted UpdraftCentral, according to the vendor.
- The attacks: Patchstack saw an attacker holding valid keys install backdoored plugins through UpdraftCentral from 15:32 on October 18 to 09:23 on October 19, about 18 hours. It counted 99 distinct plugin names; one, "Site Health Cache", kept coming back.
- What the backdoor does: it creates an account that looks like an Editor but can change settings and install plugins, and that account survives when the plugin is removed, per Patchstack and Nethemba. Nethemba also describes a later variant that creates a full administrator.
- The fix: UpdraftPlus 1.26.13 and 2.26.13 disconnect every UpdraftCentral connection made before 22:00 BST on October 18, according to TeamUpdraft.
- Nethemba's caveats: the previous release, 1.26.12/2.26.12, deleted no keys at all because of a bug, and 1.26.13 only removes keys created before 12:07 UTC on October 18 on its own; keys created between then and 21:00 UTC have to be deleted by hand. It adds that on October 20 the attacker went back to try already removed backdoors on at least three sites.
- How many sites: there is no count. Nethemba puts an upper bound of about 400,000 sites, based on an earlier vendor estimate, and says it does not know how many the attacker actually reached.
What changes and what doesn't
This is not a bug in the plugin code: it is stolen keys, so updating does not clean a site that was already entered. TeamUpdraft said on October 20 that the access to its systems has been resolved; Nethemba logged attempts that same day against sites that had already been hit. Free UpdraftPlus users with no teamupdraft.com account need no special action, the vendor says, beyond keeping the plugin updated.
How to tell if you're affected
- Check the version. In WordPress, under Plugins, find UpdraftPlus and install 1.26.13 or 2.26.13. One step of the vendor's notice still names 1.26.12; that release is not enough.
- Look for UpdraftCentral keys. Under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral, check for keys and delete any you don't use. Nethemba warns a key may exist even if you never used the feature, because the box to add the site to UpdraftCentral is ticked by default when you sign in with a TeamUpdraft account. Backups keep working without it.
- Review users and plugins. Look for accounts you don't recognize, especially with the display name "Site Tools" or @example.com or @example.org emails, and for unknown plugins, including the Must-Use tab. Nethemba notes those email patterns can match real shop customers, so a match alone proves nothing. If something looks wrong, treat the site as compromised: restore a backup from before October 17 and change every admin password.
- If you use UpdraftVault, reconnect it with your new teamupdraft.com password and run a manual backup to confirm. If you use UpdraftClone and shared keys with clients, the old ones no longer work: copy the new ones from your account.
- Change your teamupdraft.com password by typing the address yourself, not from a link, and distrust emails claiming to come from TeamUpdraft.
- If someone else runs your site, ask three things: which UpdraftPlus version it has, whether it was connected to cloud UpdraftCentral, and whether users and plugins have been reviewed.
Related: Rank Math PRO Shipped Malware: What Site Owners Should Do
Sources
- TeamUpdraft, "Security incident October 2026", October 19, 2026, updated October 20
- Patchstack, Dave Jong, October 19, 2026
- Nethemba, Pavol Lupták, October 19, 2026, updated October 21
- BleepingComputer, October 20, 2026
Updates: if TeamUpdraft explains how the attacker got in or how many sites received a backdoor, it will be added here with a link.