Compromised UpdraftCentral keys put 99 backdoor plugins on WordPress sites

An attacker holding a stolen remote-control key for one of WordPress's most-installed backup plugins used it to drop malicious plugins on connected sites over an 18-hour window. The owners of those sites are the ones who have to clean up today.

TeamUpdraft, the maker of UpdraftPlus, published a security notice on 19 October 2026 saying it had detected unauthorised access to its own site at teamupdraft.com. UpdraftPlus runs on more than three million active WordPress installations, which Patchstack confirms as the exposure figure. Search Engine Journal's coverage adds the fix: UpdraftPlus 1.26.13 (free) and 2.26.13 (premium) were released on 19 October and now disconnect UpdraftCentral automatically.

What the attacker did with the key

UpdraftCentral is UpdraftPlus's own remote-management service: a site owner connects a WordPress install to teamupdraft.com, and signed commands from there can install plugins or run tasks on it. TeamUpdraft states that the attacker reached its site over the weekend of 17 to 18 October 2026 and used a compromised key to push commands to connected customer sites.

Dave Jong at Patchstack, writing on 19 October, documented the next step. Each signed plugin.upload_plugin command delivered a small backdoor plugin, hooked into WordPress's early request pipeline. A secret URL parameter triggered the plugin to create an admin-privileged user, with a hardcoded password and both manage_options and install_plugins capabilities, then let the attacker log in by cookie, past two-factor and any login hardening in place. 99 distinct backdoor plugin names were used across the campaign; the one Patchstack saw most often was called "Site Health Cache", with the description "Small maintenance toolkit: keeps option storage tidy".

Patchstack places the first installation at 15:32 UTC on 18 October and the last it observed at 09:23 UTC on 19 October.

What a site operator has to check today

The TeamUpdraft notice sets out five steps for any site that was connected to UpdraftCentral. Change the password on the teamupdraft.com account. Update to UpdraftPlus 1.26.13 or 2.26.13, which disconnects UpdraftCentral keys automatically. Review admin users and remove any that are unfamiliar, with attention to accounts given an Editor role that behave like admins. Scan the plugin list for unfamiliar entries, including innocuous-sounding maintenance helpers. Then reset every administrator password.

TeamUpdraft also recommends that site owners who find signs of a compromise restore from a backup taken before 17 October, and keep the current state for review.

Patchstack's own detection rules caught the pattern on 19 October, and the TeamUpdraft notice says the UpdraftCentral service has been locked down, so a key stolen before 18 October is useless now. A site that connected UpdraftPlus to UpdraftCentral at any point before that date still has to audit, because the backdoor plugin lands on disk and persists through a key revocation.

Source

TeamUpdraft security incident: What customers need to know, TeamUpdraft. Reported by Roger Montti at Search Engine Journal and analysed by Dave Jong at Patchstack.