Email us

01606 800 400

Contact

Free Guide to Managing Your
WordPress Website

|

|

Stolen UpdraftPlus Keys Are Being Used to Backdoor WordPress Sites, and Updating Won’t Fix It

A row of keys hanging on hooks, with one hook empty

Over the weekend of 17 and 18 October, someone broke into TeamUpdraft’s own systems. TeamUpdraft makes UpdraftPlus, the backup plugin installed on more than 3 million WordPress sites. The attackers took the customer database, and with it the connection keys for UpdraftCentral, the company’s remote management service.

Those keys are now being used to plant hidden backdoors on WordPress sites. Security researchers saw the first one installed on the afternoon of 18 October. This is unusual in two ways. Updating the plugin does not fix it, and an infected site can look completely normal.

If you run UpdraftPlus, read on and check your site today.

What happened

UpdraftCentral lets you manage many WordPress sites from one dashboard. To make that work, each connected site holds a key that tells it to trust commands from the dashboard: run a backup, update a plugin, install a plugin.

According to TeamUpdraft’s own notice, the stolen data includes customer names, email and billing addresses, order history, hashed passwords, two-factor settings, and UpdraftCentral, UpdraftVault and UpdraftClone keys. Payment card details were not taken, and the plugin itself was not tampered with.

With a stolen key, an attacker can send your site a command to install a plugin of their choosing. Your site checks the command, finds it signed with a genuine key, and does as it is told. Security firm Patchstack has already counted 99 different names for the backdoor plugin.

Which sites are at risk

Every copy of UpdraftPlus, free and premium, includes the UpdraftCentral connector. Your site is exposed if it has an UpdraftCentral key, and you might have one without knowing it. When you connect UpdraftPlus to a TeamUpdraft account, a box labelled “Add this website to UpdraftCentral” is ticked by default. If you entered your account details to activate a premium licence or set up UpdraftVault storage, you may have created a key without meaning to.

Keys do not expire. Patchstack found keys issued in November 2025 still working this month.

Why updating won’t help

Most WordPress security scares follow the same pattern. Someone finds a bug, the developer releases a fixed version, and you update. That is what happened in June, when UpdraftPlus 1.26.5 fixed a flaw tracked as CVE-2026-10795.

This time there is no bug in your copy of the plugin. The attacker is using real keys, so the plugin is working exactly as designed when it accepts their commands. The latest release, 1.26.11 (2.26.11 for premium), is just as exposed as older ones. The only fix is to delete the key from your site.

TeamUpdraft says it is preparing an emergency release that will disconnect every UpdraftCentral connection made before 22:00 BST on 18 October. At the time of writing it has not been released. Even when it arrives, a site that was backdoored before you install it stays backdoored.

Why you might not notice

The backdoor is built to stay out of sight. Researchers at Nethemba and IT-Connect, who found it on their own sites, describe how it works:

  • The plugin hides itself from the plugins list in your dashboard, and uses dull names such as “Site Health Cache” or “Type Stack 285”.
  • It does nothing until the attacker visits your site with a secret code in the web address. Then it creates a hidden user account with enough rights to change settings and install more plugins.
  • It logs the attacker straight in, which skips your login page, two-factor authentication and any login protection plugin.
  • The hidden account survives if the plugin is later removed.
  • If you delete the plugin from the WordPress dashboard, its uninstall routine erases the evidence.

Both research teams only found out because some versions of the backdoor contain a coding error that crashes the site. The sites that went down were the lucky ones. A working copy gives no visible sign at all.

Why you may not have heard about it

TeamUpdraft moved fast. It closed the attackers’ route in, signed out every account, reset every UpdraftVault connection, replaced every UpdraftClone key and started work on the emergency release. It published its notice on 19 October.

Outside that notice and a handful of security researchers, the story has had very little coverage. TeamUpdraft cannot reach into your site and remove a key for you. If nobody tells you, the key stays there and keeps working.

What to do now

Do this for every site that runs UpdraftPlus, even if you have never used UpdraftCentral on purpose.

  1. Log in to the site’s own WordPress dashboard directly, not through UpdraftCentral.
  2. Go to Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral, open the list of existing keys and delete every one. Removing the site from the UpdraftCentral dashboard is not enough. Your backups carry on working without the key.
  3. Go to Users and look for accounts you don’t recognise. Pay attention to names made of two words and two digits, such as data-ops43, an email address ending in @example.org, or the display name “Site Tools”. Check Editors as well as Administrators, because the backdoor account is an Editor with extra rights.
  4. Check the plugins on the server itself, using your host’s file manager or FTP, because the backdoor does not show in the dashboard. Look in wp-content/plugins for folders you don’t recognise or that were created on or after 18 October. One reliable sign is a plugin described as “Small maintenance toolkit: keeps option storage tidy.”
  5. Change the password for every administrator account, and for your TeamUpdraft account if you have one. Go to teamupdraft.com by typing the address yourself, not from a link in an email.
  6. Update UpdraftPlus to the latest version. It won’t stop this attack, but sites still on 1.26.4 or earlier are open to the June flaw as well.

If you use the WordPress command line, wp option get updraft_central_localkeys shows whether a site holds any keys, and wp option delete updraft_central_localkeys removes them.

Our advice is to leave UpdraftCentral disconnected for now. TeamUpdraft says you can reconnect once the key is deleted, but Patchstack and Nethemba both recommend waiting until the company explains how the keys leaked. Unless you use UpdraftCentral every day, you lose nothing by waiting.

If you find the backdoor

Treat the whole site as compromised. Delete the UpdraftCentral key first, so the attacker can’t simply reinstall it. Then move the plugin folder out of wp-content/plugins using your file manager rather than deleting it from the dashboard, so the evidence survives. Remove the hidden account, change every password and sign out all users.

The safest route is to restore the site from a backup taken before 17 October, then delete the key again on the restored copy. If you are not comfortable doing this yourself, get help from someone who is. A site that is only partly cleaned can still let the attacker back in.

WP Support Agency clients: nothing to do

If we look after your site, you don’t need to do anything. We use UpdraftPlus Premium for offsite backups to your own storage, but we don’t use UpdraftCentral to manage your site. We have checked every site we manage for UpdraftCentral keys, and we are watching for TeamUpdraft’s emergency release so we can apply it as soon as it is out.

This is the part of looking after a website that nobody sees. The threat arrived over a weekend, through a company most site owners have never heard of, and the usual fix of clicking “update” doesn’t work. Someone has to be watching, understand what the problem is and act on it the same day. That is what our clients pay us for.

If you have a question about your own site, get in touch and you will speak to someone who knows it.

Not a client yet? Our hosting, maintenance and support plans cover this kind of work as standard. If you would like to know where your site stands today, request a free website review and we will tell you, in plain English, what needs attention.

References

Previous Post