Fix guides / Security notices

Security notice

Attackers used stolen keys to plant backdoors on WordPress sites. Check yours now.

Last updated: Wednesday, October 21, 2026, 4:11 PM ETStatus: Old keys being revoked. Sites that were reached must be checked and cleaned now.

TeamUpdraft, the company behind UpdraftPlus, one of the most widely used WordPress backup plugins, says an attacker got into its website over the weekend of October 17 and 18, 2026, and likely accessed its customer database. That database held the connection keys for UpdraftCentral, its service for managing many WordPress sites from one place. Those keys can send commands to connected sites. Security researchers say attackers have used the stolen keys to install hidden back doors on WordPress sites and create accounts that let them log straight in, skipping the login page and two-step login. An UpdraftPlus update now cuts off the old keys, but it does not remove anything the attackers already planted. Many sites have a key even though their owners never knowingly used UpdraftCentral. If your website or online store runs on WordPress with UpdraftPlus, ask whoever looks after it to check it today.

What happened

UpdraftPlus is a WordPress plugin that backs up websites, used on millions of sites. Its maker, TeamUpdraft, also runs UpdraftCentral, a service agencies and site owners use to manage many WordPress sites remotely, plus UpdraftVault (backup storage) and UpdraftClone (test copies of sites). (TeamUpdraft, BleepingComputer)

Where things stand

Who should worry

A normal visitor to a WordPress website is not at risk from the stolen keys themselves. The danger is to the owners of sites the attackers could reach, because a back door gives them control of the whole site.

Check today if any of these are true:

You are not affected by the key theft if your site does not run UpdraftPlus, or if you only use self-hosted UpdraftCentral. (TeamUpdraft)

If you run a web agency

UpdraftCentral exists to manage many sites from one dashboard, so agencies carry the most risk here. One stolen dashboard key can reach every client site connected to it. (TeamUpdraft, Patchstack)

What to do now

Do these today.

  1. Ask the question. If someone else looks after your site, send them the message below. You need a clear answer: does the site run UpdraftPlus, does it have an UpdraftCentral key, and has it been checked for back doors?
  2. Make sure UpdraftPlus is up to date. It should be 1.26.13 (free) or 2.26.13 (Premium) or later. (TeamUpdraft, WordPress.org changelog)
  3. Delete the UpdraftCentral key on the site itself. Log in to the site's own WordPress dashboard, not through UpdraftCentral, and go to Settings, then UpdraftPlus Backups, then Advanced Tools, then UpdraftCentral, then Manage existing keys. Delete every key. Backups keep working afterwards. (TeamUpdraft, BleepingComputer, Patchstack)
  4. Look for strangers. Under Users, look for any account you do not recognise, not only administrators, because the back door can hide as an Editor. Under Plugins, including the Must-Use tab if you see it, look for anything you did not install. (TeamUpdraft, Patchstack)
  5. Change the passwords for every administrator on the site. (TeamUpdraft)
  6. Change your teamupdraft.com password. Type teamupdraft.com into your browser rather than following a link in an email, change the same password anywhere else you use it, and reset your two-step login there if you use it. Be wary of emails claiming to be from TeamUpdraft. It says it will never ask for your password or keys. (TeamUpdraft)
  7. If anything looks wrong, get help. A site with a strange account or plugin should be treated as broken into. Researchers advise restoring it from a backup taken before October 17, then changing passwords and checking it again. (TeamUpdraft, CSO Online, Patchstack)
  8. If the site was reached through UpdraftCentral, reconnect your backup storage (such as Google Drive, Dropbox or Amazon S3) and change its access keys, as TeamUpdraft advises. (TeamUpdraft)

Not seeing anything is not the same as being clean. Some versions of the back door hide from the plugin list or leave no account behind. (Nethemba) Ask your developer or host to run the technical checks below.

What to send your developer, agency or host

TeamUpdraft reports that teamupdraft.com was breached on October 17 and 18, 2026, and that UpdraftCentral Cloud connection keys were likely taken. Patchstack and Nethemba report attackers using those keys to send plugin.upload_plugin commands that installed backdoor plugins (at least 99 names, all with the description "Small maintenance toolkit: keeps option storage tidy.") and created hidden privileged accounts. Please confirm for each of our WordPress sites: is UpdraftPlus at 1.26.13 / 2.26.13 or later, have all keys in updraft_central_localkeys been deleted on the site itself, and have you checked plugin files on disk, users with extra capabilities and the access logs for the indicators Patchstack and Nethemba published? If anything is found, please treat the site as compromised, restore from a backup taken before October 17, rotate admin passwords and remote storage keys, and tell us what you found. Sources: TeamUpdraft, Patchstack, Nethemba.

Technical steps for developers

These steps come from the published guidance. Read the Patchstack analysis and the Nethemba analysis for the full list of indicators, file hashes and Nethemba's read-only checking script.

Step 1. Find out if the site has a key

Any output means the site is exposed. Check every site running UpdraftPlus, including ones that never knowingly used UpdraftCentral. (Patchstack)

wp plugin get updraftplus --field=version
wp option get updraft_central_localkeys

Step 2. Delete the keys first

Delete keys on the site before cleaning anything, or the attacker can push a working replacement. (Patchstack, Nethemba) In wp-admin go to Settings, then UpdraftPlus Backups, then Advanced Tools, then UpdraftCentral, then Manage existing keys, and delete every key. Or:

wp option delete updraft_central_localkeys

Do this even on 1.26.13 / 2.26.13. Nethemba reports that 1.26.13 does not delete keys created on October 18 between 12:07 and 21:00 UTC. (Nethemba)

Step 3. Look for the back door on disk

Every sample Patchstack saw carries the same plugin description. Search the files directly, since at least one variant hides from the admin plugin list. (Patchstack, Nethemba)

grep -rl "Small maintenance toolkit: keeps option storage tidy\." /var/www/*/wp-content/plugins/ /var/www/*/wp-content/mu-plugins/

Nethemba's checking script also catches variants that carry a different description. (Nethemba)

If you find one, do not repair it. Deactivate it and move it out of the web root rather than deleting it through wp-admin, because its uninstall routine erases its own traces. Remove its _sync_token option. (Patchstack)

Step 4. Find hidden accounts by capability, not by name

The account is disguised as an Editor with manage_options and install_plugins. Known markers: usernames of two words plus two digits, an @example.org email address and the display name "Site Tools". (Patchstack)

wp db query "SELECT u.user_login,u.user_email FROM wp_users u JOIN wp_usermeta m ON m.user_id=u.ID WHERE m.meta_key='wp_capabilities' AND m.meta_value LIKE '%editor%' AND m.meta_value LIKE '%manage_options%'"

Adjust the table prefix if the site does not use wp_.

Step 5. Check the logs

A hit on the trigger parameter means the back door was used, not merely installed. Genuine UpdraftCentral traffic carries a library version and URL in its User-Agent, and the attacker's did not. (Patchstack)

grep -E '[?&]_[A-Za-z0-9]{4,10}=[A-Za-z0-9_]{32}([&"[:space:]]|$)' access.log
grep 'class-udrpc\.php"' /var/log/apache2/*access*

In the UpdraftCentral log, look for Command received: plugin.upload_plugin. Source addresses seen so far are 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9, but the attacker rotated infrastructure, so do not rely on IP blocking. (Patchstack, Nethemba)

Step 6. If anything is found, treat the site as fully compromised

Restore from a backup taken before October 17, compare files against a clean install, review every user with extra capabilities, rotate admin and UpdraftCentral Cloud passwords, end all sessions and turn on two-step login. If the site was accessed through UpdraftCentral, re-authorise remote storage and rotate storage access keys. (Patchstack, TeamUpdraft) Hold off on reconnecting to UpdraftCentral until TeamUpdraft explains the cause. If you need remote management, create the key under an account without install_plugins. (Patchstack)

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. It means keys that can control WordPress sites were stolen and have been used against some sites. Only a check of your own site can tell you whether it was one of them. Your developer, agency or host can do that.

Can EverThread tell me if I am affected?

Not directly. EverThread checks websites from the outside, the way a browser sees them. It cannot see your WordPress admin users, your installed plugins or your UpdraftCentral keys, so it cannot tell whether your site had a key or whether a key was used. If an attacker changes what your visitors see, our scans may catch some of those visible after-effects on the pages we check, such as spam text added to your page, your address forwarding to another website or deliberately scrambled code on your page. They only show up if they appear on those pages, and many back doors stay quiet, so no warning from us does not mean your site is clean. Use the steps above, or ask your developer, agency or host to check.

I never used UpdraftCentral. Am I safe?

Not necessarily. Linking a teamupdraft.com account inside UpdraftPlus ticks a box that adds the site to UpdraftCentral by default, so some sites have a key nobody chose to create. (Patchstack, Nethemba) Check for a key on every site running UpdraftPlus. If you do not use UpdraftPlus at all, the stolen keys cannot reach your site.

UpdraftPlus updated itself. Is that enough?

No. The update cuts off most old keys, but it does not remove plugins, accounts or sessions the attacker already created. (CSO Online, TeamUpdraft) Researchers also report that it misses some keys, so delete them by hand. (Nethemba)

Are my backups safe?

TeamUpdraft says backups in your own Google Drive, Dropbox or Amazon S3 were not affected. If your site was reached through UpdraftCentral, reconnect that storage and change its access keys as a precaution. If you need to restore, use a backup from before October 17. (TeamUpdraft)

Was my card number stolen?

TeamUpdraft says it does not store card details. Card payments are handled by Stripe and PayPal. Your name, email, billing address, order history and scrambled password were likely in the accessed database, so change your teamupdraft.com password and watch for fake emails claiming to be from TeamUpdraft. (TeamUpdraft)

Where can I follow official updates?

TeamUpdraft is updating its security incident post. The UpdraftPlus changelog on WordPress.org lists each release.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan cannot see your WordPress users, plugins or UpdraftCentral keys, so it cannot tell you whether a stolen key was used on your site. No account.

Or sign up free and we check it every day and email you when something changes.