UpdraftCentral: stolen keys used to install backdoors on WordPress sites

TeamUpdraft, the company behind UpdraftPlus — over 4 million active installations — has made public a security incident on its website teamupdraft.com. Anyone managing WordPress sites with this backup plugin must take immediate action, as the attack is already underway and no patch is yet available to stop it.

What happened

The company reported detecting unauthorised access to teamupdraft.com during the weekend of 17–18 October 2026. According to the manufacturer's official statement, potentially exposed data includes names, email addresses, billing addresses and order history, account passwords stored only in hashed form, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.

Impacted by breach	Not impacted
UpdraftCentral, UpdraftVault, UpdraftClone keys	UpdraftPlus plugin and its downloads
Account data (names, email, billing)	Backups on own remote storage (Google Drive, Dropbox, S3)
Password hashes, 2FA settings	Self-hosted UpdraftCentral

Source: official incident page published by TeamUpdraft.

Why updating the plugin is not enough

The critical point, confirmed by technical analysis published by Nethemba after discovering a backdoor on their own sites, is that the attacker did not gain entry by forcing the servers or exploiting a configuration weakness, but through UpdraftCentral's remote management channel, signing commands with valid private keys from the dashboard. Nethemba further clarifies that this is not the CVE-2026-10795 that Wordfence reported in June: their sites were patched against that vulnerability and attempts to exploit it had failed.

Patchstack confirms that at present this is not a vulnerability in UpdraftPlus and no plugin update will stop it: commands are correctly encrypted and signed with authentic private keys from the dashboard, and every plugin check passes because from the site's perspective the instruction is legitimate.

What to do now

In WordPress administration: Settings → UpdraftPlus Backups → "Advanced Tools" tab → "UpdraftCentral" → "Manage existing keys" → "Delete" on each key present. From the command line, in the site root: wp option delete updraft_central_localkeys, followed by removing the site from the UpdraftCentral panel as well (teamupdraft.com → My account → UpdraftCentral → remove site).

Patchstack reports that the campaign ran continuously for an 18-hour window between 18 and 19 October. TeamUpdraft is preparing an emergency release that will automatically disconnect every UpdraftCentral connection established before 22:00 BST on 18 October, so the old keys will cease to work on every site. Until then, manual removal remains the only available countermeasure.