UpdraftPlus Backdoor Attack: What Happened and How to Protect Your Sites

The short answer

Since October 18, 2026, an attacker has been installing backdoor plugins on WordPress sites running UpdraftPlus. They use UpdraftCentral remote-access keys taken from TeamUpdraft’s customer database, which TeamUpdraft says was accessed over the weekend of October 17–18. The commands are validly signed, so updating UpdraftPlus does not stop them.

To protect a site: delete every UpdraftCentral key on it, check for the backdoor and its hidden account, and block the channel the attacker uses. In full cooperation with Patchstack, WP Umbrella is making its Security add-on free for 30 days on every site where UpdraftPlus is installed.

Item	Detail
Type	Remote-management key compromise leading to backdoor installation
CVE	None: this is not a flaw in the plugin’s code
Affected	All UpdraftPlus versions, free and premium, on sites with an active UpdraftCentral key
First backdoor seen	October 18, 2026, 15:32 (Patchstack telemetry)
Fixed version	None yet. TeamUpdraft is preparing an emergency release
Immediate fix	Delete the UpdraftCentral keys stored on each site

What is happening with UpdraftPlus?

TeamUpdraft, the company behind UpdraftPlus, says someone gained unauthorised access to teamupdraft.com over the weekend of October 17–18, 2026, and that it believes its customer database was accessed. The exposed data may include connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft says the UpdraftPlus plugin and its downloads were not affected.

The attacker is using those UpdraftCentral keys to push backdoor plugins onto connected WordPress sites. Patchstack recorded the first installation at 15:32 on October 18, and installations continued until at least 09:23 on October 19. It has seen 99 different backdoor plugin names so far.

The attack was first spotted by Nethemba, a security firm that found it on three of its own sites early on October 19 and published the first analysis.

Why doesn’t updating UpdraftPlus fix it?

Because nothing in the plugin is broken. Every site connected to UpdraftCentral runs any command signed with the dashboard’s private key, without asking anyone to confirm it. The attacker holds genuine keys, so their commands pass every check the plugin makes. Patchstack confirms the latest releases, 1.26.11 and 2.26.11, are affected exactly like older ones.

TeamUpdraft is preparing an emergency UpdraftPlus release that will automatically disconnect UpdraftCentral connections made before 22:00 BST on October 18. It has not given a date. Until it ships, the keys already stored on your sites are the open door.

This is a separate problem from CVE-2026-10795, the UpdraftCentral flaw fixed in June 2026 in versions 1.26.5 and 2.26.5. Sites still below those versions are exposed to both.

Which sites are affected?

Any site running UpdraftPlus, free or premium, that holds an active UpdraftCentral key. Many sites hold one without their owners knowing. When you connect a TeamUpdraft.com account inside UpdraftPlus, a checkbox that adds the site to UpdraftCentral is ticked by default, so one account connection is enough to create a key.

Keys also don’t expire: Patchstack found keys issued in November 2025 still working in October 2026. If you’re not sure whether a site was ever connected, treat it as exposed and check it using the steps below.

Self-hosted UpdraftCentral installations are not affected, according to TeamUpdraft.

How does the backdoor work?

1. The attacker sends a signed plugin.upload_plugin command to the site’s UpdraftCentral channel, which listens on ordinary POST requests to the site root.
2. WordPress installs and activates the plugin through its standard installer. Most copies get a random two- or three-word name; “Site Health Cache” is the name reused most often.
3. The plugin waits for a secret 32-character token in a URL parameter.
4. When the token arrives, it creates an account with a hardcoded password, gives it the Editor role, then quietly adds the manage_options and install_plugins capabilities.
5. It logs the attacker in by setting a cookie directly, which skips the login form, two-factor authentication and login-protection plugins.

The account shows as an Editor, so reviewing your list of administrators misses it. It also stays in WordPress after the plugin is removed.

Early samples contained a bug that made affected sites return HTTP 500 errors, which is how the first victims noticed. Patchstack warns not to repair such a plugin: fixing the error switches the backdoor on.

How do I check if my site was hit?

1. Check whether the site holds an UpdraftCentral key. Any output means the site is exposed:

wp option get updraft_central_localkeys

Without WP-CLI, go to Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral. The message “There is no UpdraftCentral dashboard currently able to control this site” means no key is active.

2. Look for the backdoor plugin. Names change, but every sample analysed so far carries the same plugin description:

grep -rl "Small maintenance toolkit: keeps option storage tidy\." /var/www/*/wp-content/plugins/

3. Look for the hidden account. Search by capability, not by name, since it is disguised as an Editor:

wp db query "SELECT u.user_login,u.user_email FROM wp_users u JOIN wp_usermeta m ON m.user_id=u.ID WHERE m.meta_key='wp_capabilities' AND m.meta_value LIKE '%editor%' AND m.meta_value LIKE '%manage_options%'"

4. Check your access logs for the activation trigger. A match means the backdoor was used, not just installed:

grep -E '[?&]_[A-Za-z0-9]{4,10}=[A-Za-z0-9_]{32}([&"[:space:]]|$)' access.log

Other signs Patchstack lists: usernames made of two words plus two digits (data-ops43 and media-staff96 are confirmed), an email address at @example.org, the display name “Site Tools”, and a database option ending in _sync_token. The attacker used the addresses 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9 but rotated them within a day, so blocking IPs won’t protect you.

What should I do now?

The order matters.

1. Delete every UpdraftCentral key on the site. In wp-admin: Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys, then delete each one. Or run wp option delete updraft_central_localkeys. Removing the site from the UpdraftCentral dashboard is not enough, because the key that matters lives on the site. Your backups keep working; only remote management stops.
2. If you find the backdoor, delete the key first. Otherwise the attacker can push a replacement. Then deactivate the plugin and move it out of the web root instead of deleting it in wp-admin, since its uninstall routine erases its own traces. Remove the _sync_token option and the hidden account.
3. If the account exists or the trigger appears in your logs, treat the site as fully compromised. Restore from a backup taken before October 17, compare files against a clean install, review every user with extra capabilities, change all administrator passwords, end all sessions and turn on two-factor authentication.
4. Secure your TeamUpdraft account. TeamUpdraft asks every teamupdraft.com account holder to change their password, reset two-factor authentication, and watch for emails that pretend to come from TeamUpdraft.
5. Be careful about reconnecting to UpdraftCentral. TeamUpdraft says a site you clean and reconnect manually will stay connected after its emergency release. Patchstack advises waiting until TeamUpdraft explains the cause, and, if you need remote management now, creating the key under an account without the install_plugins capability.

Our response: the WP Umbrella Security add-on, free for 30 days

Due to the severity and exceptional nature of this incident, we’ve decided, in full cooperation with Patchstack, to offer our Security add-on free for 30 days on all websites where UpdraftPlus is installed.

It includes:

• Virtual patching. Blocks this attack by shutting down the channel the attacker uses, while you clean up your keys.
• Malware scanner. Tells you whether a site has already been hit. If it has, our team handles the cleanup.
• Security-focused activity logs. Help you spot unexpected plugin installs and account changes, the two traces this attack leaves.

This will give you the time to clean everything up. When it’s done, you can deactivate the add-on.

While the add-on is active, UpdraftCentral dashboards will show your sites as unreachable. Scheduled backups keep running as usual.

Activate free protection →

Timeline

Date (2026)	Event
Oct 19	WP Umbrella makes its Security add-on free for 30 days on every UpdraftPlus site, with Patchstack
Oct 19	TeamUpdraft publishes its incident notice and announces an emergency release, with no date
Oct 19	Patchstack deploys mitigation rules and starts blocking UpdraftCentral remote commands
Oct 19	Nethemba publishes its analysis and reports the incident to TeamUpdraft
Oct 19, 09:23	Most recent backdoor installation in Patchstack telemetry
Oct 19, early hours	Nethemba detects the attack on three of its own sites
Oct 18, 15:32	First backdoor installation in Patchstack telemetry
Oct 17–18	Unauthorised access to teamupdraft.com, according to TeamUpdraft
June	CVE-2026-10795, a separate UpdraftCentral flaw, fixed in UpdraftPlus 1.26.5 and 2.26.5

Frequently asked questions

Is UpdraftPlus safe to use right now?

The plugin’s code is not compromised, and backups to your own storage keep working. The risk comes from UpdraftCentral keys stored on your sites. Once those are deleted and the site is checked, UpdraftPlus can keep running your backups.

Does updating UpdraftPlus fix the backdoor?

No. The attacker’s commands are signed with genuine keys, so every version accepts them, including 1.26.11 and 2.26.11. TeamUpdraft’s emergency release will disconnect older UpdraftCentral connections, but it has no date yet and won’t remove a backdoor that’s already installed.

I never used UpdraftCentral. Am I affected?

Assume so. Connecting a TeamUpdraft.com account inside UpdraftPlus creates an UpdraftCentral key by default. Run wp option get updraft_central_localkeys or check the UpdraftCentral tab to be sure.

How do I know if my site was hacked?

Look for a plugin described as “Small maintenance toolkit: keeps option storage tidy.”, an Editor account that also has manage_options, and the activation trigger in your access logs. The full checks are in the section above.

Is there a CVE for this?

No. It is a key compromise, not a code flaw. It is unrelated to CVE-2026-10795, which was fixed in June 2026.

What is WP Umbrella offering?

Our Security add-on (virtual patching, malware scanner and security-focused activity logs) is free for 30 days on every site where UpdraftPlus is installed, in full cooperation with Patchstack. If a site has been hit, our team handles the cleanup. Activate it here.