Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites: Update to UpdraftPlus 1.26.13 and Delete Keys by Hand

TeamUpdraft, the developer of the UpdraftPlus backup plugin (more than 4 million active installs), has confirmed that attackers accessed teamupdraft.com over the weekend of 17–18 October 2026. The vendor believes its customer database was exposed, including the connection keys for its cloud-hosted UpdraftCentral remote-management service, as well as UpdraftVault and UpdraftClone keys.

Those UpdraftCentral keys can send signed commands to every connected WordPress site, and attackers used them.

What the attackers did

Patchstack says an attacker holding valid UpdraftCentral keys sent signed plugin.upload_plugin commands over UpdraftPlus's remote procedure call channel, which listens on ordinary POST requests to the site root. WordPress then installed and activated the supplied plugin. The campaign ran for about 18 hours across 18 and 19 October.

Slovak firm Nethemba, which first spotted the attacks, describes the rogue plugin as a backdoor that checks every request for a secret URL parameter and token, then creates an account with Editor rights plus manage_options and install_plugins. A later version created a full administrator. Crucially, the account it creates stays in WordPress after the plugin is removed.

Patchstack counted 99 distinct backdoor plugin names. Indicators published so far include:

• Plugin names such as Site Health Cache, Asset Forge 2, Content Helper, Wp Forge, Query Shelf, Nav Hub, Speed Desk, Link Latch and Feed Case, each carrying the line "Small maintenance toolkit: keeps option storage tidy."
• User accounts such as data-ops43, system_team850, web.tech988, cmseditor170, cms.tech644 and web_mgr684, often with an @example.com email.
• Source IPs 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9.

The fix, and its gaps

• UpdraftPlus 1.26.12 / 2.26.12 does not work. Nethemba and WPSec found that a bug meant the emergency release revoked no keys at all.
• UpdraftPlus 1.26.13 (free) / 2.26.13 (Premium), released the evening of 19 October and pushed automatically by WordPress.org, deletes UpdraftCentral cloud keys created before 12:07 UTC on 18 October.
• According to Nethemba, keys created between 12:07 and 21:00 UTC on 18 October are not removed by 1.26.13, even though the vendor considers them exposed. Delete those by hand.
• Self-hosted UpdraftCentral is not affected, and backups stored in your own Google Drive, Dropbox or S3 were not touched.

This is also the second problem in this channel in five months: CVE-2026-10795, fixed in 1.26.5 / 2.26.5 in June, let attackers forge UpdraftCentral commands with no key at all. Sites still below those versions face both issues.

What to do on every affected site

TeamUpdraft's own checklist, done directly in each site's WordPress dashboard rather than through UpdraftCentral:

1. Confirm UpdraftPlus is on 1.26.13 / 2.26.13 or later.
2. Delete the UpdraftCentral connection key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral.
3. Remove any administrator or editor accounts you don't recognise.
4. Check Plugins, including the Must-Use tab, and remove anything unfamiliar.
5. Change all administrator passwords, and re-authorise remote storage if the site was accessed.
6. If you find signs of compromise, consider restoring from a backup taken before 17 October.

If you have a teamupdraft.com account, change that password too and reset its 2FA.

Why it matters

Updating the plugin closes the door, but it does not evict anyone who already got in. Hidden accounts and must-use plugins are exactly the kind of persistence that survives a routine update, and many sites this week are juggling this alongside the PHP2Shell patches.

If you manage older WordPress sites and aren't sure whether they were touched, RescuePHP can audit them for leftover accounts and backdoors and help bring the PHP and plugin stack up to date.

Sources: TeamUpdraft incident notice, Nethemba analysis, The Hacker News, WPSec WPSEC-2026-1273.