Key Highlights
Attackers used stolen UpdraftCentral security keys to target connected WordPress websites.
Malicious plugins could create unauthorised accounts with administrator privileges.
TeamUpdraft released security updates to revoke compromised connections.
Website owners should update the plugin and check for suspicious plugins and user accounts.
A security breach involving TeamUpdraft, the company behind the popular WordPress backup plugin UpdraftPlus, has exposed connected websites to potential backdoor attacks. The incident involved stolen UpdraftCentral security keys that allowed attackers to send unauthorised commands to connected WordPress websites.
UpdraftPlus has more than 3 million active installations, but the incident specifically affects websites with active UpdraftCentral Cloud connections, not every website using the plugin.
How Did the Security Breach Happen?
TeamUpdraft confirmed that its website was compromised over the weekend of October 17–18, 2026. Attackers may have accessed customer information and connection keys used by UpdraftCentral.
These keys allow remote management commands to reach connected WordPress websites without requiring a separate login to each site.
Security company Patchstack explained the issue:
“This is not a vulnerability in UpdraftPlus, and as of 19 October no plugin update stops it.”
The initial analysis indicated that attackers were using legitimate but compromised security keys rather than exploiting a conventional plugin coding vulnerability. TeamUpdraft subsequently released updates to revoke affected connections.
Malicious Plugins and Unauthorised Accounts
Attackers used compromised keys to install and activate malicious plugins on affected websites. These plugins contained backdoors that could create unauthorised WordPress accounts and grant them administrative privileges.
Patchstack identified 99 names associated with malicious plugins, including names that resembled legitimate website maintenance tools.
Although some malicious plugins reportedly contained a coding error, website owners should not assume their sites are safe without checking for signs of compromise.
How WordPress Website Owners Can Protect Their Sites
TeamUpdraft released UpdraftPlus versions 1.26.13 for the free version and 2.26.13 for the premium version on October 19, 2026. Website owners should install the latest available version and review their websites for suspicious activity.
Recommended actions include:
Update UpdraftPlus to the latest available version.
Review installed plugins for unfamiliar or suspicious additions.
Check WordPress user accounts for unauthorised administrators.
Remove compromised UpdraftCentral connection keys.
Change administrator and TeamUpdraft account passwords.
Restore a clean backup from before October 17 if a compromise is confirmed.
Updating the plugin helps block further access through the compromised connections, but it does not automatically remove malicious plugins or unauthorised accounts already installed.
WordPress Security Best Practices After the UpdraftPlus Breach
This incident highlights the importance of protecting website credentials and securing remote management tools. Compromised security keys can allow attackers to gain unauthorised access, even when a plugin's security checks are functioning correctly.
WordPress website users should keep plugins updated, review user permissions regularly, monitor suspicious activity, and maintain secure backups to protect their websites against potential security threats.
