Update, October 30: TeamUpdraft updated its notice on October 29. It now says some sites were compromised during the original incident and had a plugin left behind that later created an administrator account, so a site that looked fine in the first days could still be affected. It names more example backdoor plugins (Asset Forge 2, Core Smith, Data Engine Cc0, Image Forge, Quick Pack, Seo Helper and WP Forge, alongside Site Health Cache) and says this is not a full list. It also gives example usernames (data-ops43 and media-staff96), says to look for database entries containing _sync_token, and warns that malicious plugins can hide from the Plugins and Users screens, so check the plugins and mu-plugins folders directly. This comes from TeamUpdraft; I have not seen independent confirmation of the new details yet.
Update, October 27: UpdraftPlus 1.26.14 (free) was released on October 26. Its WordPress.org changelog reads as a routine release and does not mention the breach, but it does turn off automatic adding of websites to UpdraftCentral by default. Keep updating to 1.26.14 or newer, and remember that no update removes a backdoor that is already installed, so the checks below still apply. I have not confirmed a matching Premium version number, so check your Premium dashboard. This comes from the plugin's changelog on WordPress.org.
Update, October 23: TeamUpdraft has added to its notice. It says the stolen connection keys also covered UpdraftVault and UpdraftClone, not just UpdraftCentral. If you use UpdraftVault, reconnect each site and run a manual backup to confirm it works, and if you use remote storage, re-authorize it and change its access keys. TeamUpdraft also advises checking the site directly in WordPress rather than through UpdraftCentral, looking in the Must-Use plugins tab, and watching for unexpected Editor accounts. It still gives no count of affected sites, and says it has contacted police and hired an outside security firm.
What happened
On October 18, 2026, security researchers began seeing a wave of WordPress sites getting a hidden back door installed. Two security firms, Patchstack and Nethemba, have written up what they found. The sites that were hit have one thing in common: they run UpdraftPlus, one of the most popular backup plugins in the world, with more than four million installs.
This is not a typical "update your plugin" story, and that is why it is worth reading carefully.
Where the stolen keys came from
Think of a hotel key card. A well-run hotel locks every door and only the right cards open them. In this case, the locks were fine. What happened is that the company that issues the cards was broken into, and the thief is now walking from door to door with copies.
UpdraftPlus includes a feature called UpdraftCentral, which lets a dashboard manage your site remotely. Each connection is protected by a private key. On October 19, TeamUpdraft said someone had gained unauthorized access to its own website over the weekend of October 17 and 18, and that connection keys were in the database that may have been accessed. It also said the database held names, email addresses, billing addresses, order history, hashed passwords and two-factor settings, but no payment card data.
Because the commands are signed with a real key, your site cannot tell them apart from the real thing. It does what it is told.
Does updating fix it?
Partly. TeamUpdraft's first attempt, version 1.26.12, was reported to have a bug that stopped it from revoking anything. Versions 1.26.13 (free) and 2.26.13 (premium), released the evening of October 19, disconnect UpdraftCentral keys created before the breach, so those stolen keys stop working.
That still leaves two problems. Reports describe a gap of a few hours on October 18 where keys created in that window were not removed automatically, so check your key list and delete anything left. And updating does not undo anything that already happened: a backdoor plugin, or the hidden account it created, stays on the site until somebody removes it.
What the attackers do once they are in
The attacker uses the key to tell your site to install a new plugin. That plugin looks harmless, often described as a small maintenance toolkit, but it is a back door. With a secret web address only the attacker knows, it can create a hidden user account on your site and log them in, skipping the normal login page entirely. That means two-factor authentication and login-protection plugins never get a chance to stop them.
From there, an attacker can do what any administrator can do: change content, redirect your visitors, steal data, or plant more malicious code. The hidden account also survives if you delete the plugin that created it.
How big is this?
The numbers are still unclear. Patchstack saw installs spread across a broad set of sites over roughly 18 hours, and found 99 different disguised plugin names, so the attacker was trying hard not to be spotted. One report put the total at around 400,000 sites, but no security firm I read has confirmed a count. Some installs never switched on, but Patchstack says those sites still received the back door and should be treated as affected. The fact that most people have not heard of UpdraftCentral is a big part of the problem, because many site owners do not know they have a key at all.
What to do today
None of these steps need a developer. They take about five minutes.
- Update UpdraftPlus. Use version 1.26.13 (free) or 2.26.13 (premium), or newer. This cuts off older keys, but it is only the first step.
- Check for keys. In your WordPress dashboard, go to Settings, then UpdraftPlus Backups, then Advanced Tools, then UpdraftCentral. Look for a link that says "Manage existing keys." If it shows a number above zero, your site is exposed. Check this even if you have never used UpdraftCentral. Patchstack notes that keys can be created by a setting that is switched on by default.
- Delete every key. Your backups will keep running. Only remote management stops. Reconnect to UpdraftCentral only once you are sure the site is clean. Also change your TeamUpdraft account password, since customer account data was in the breached database.
- Look for signs of a break-in. Open your Plugins list and look for anything you did not install, especially one called "Site Health Cache" or described as a "small maintenance toolkit: keeps option storage tidy." Then open Users and look for accounts you do not recognize, such as an Editor with the display name "Site Tools."
- If you find anything, stop and call someone. Delete the keys first. After that, do not just remove the plugin and move on, because the fake account stays behind and the plugin's own removal routine can erase the evidence. A proper cleanup means restoring from a backup taken before October 17, resetting every password, ending all logged-in sessions, and checking every user on the site.
If you manage sites with command-line access, Patchstack's article has the exact commands, a list of the disguised plugin names, and the attacker's IP addresses. Their write-up and the original analysis from Nethemba are linked at the bottom of this post.
If your site is already acting strangely, or you find one of these signs, our emergency support team can step in and contain it.
The bigger lesson
The uncomfortable part of this story is how little your own habits would have mattered. You could have kept every plugin updated, used strong passwords and turned on two-factor authentication, and still been exposed because a feature you never knowingly switched on trusted a key that leaked somewhere else.
That is why remote-access features deserve the same scrutiny as any other way into your site. Somebody should know which of them are switched on, who holds the keys, and what happens when one of those keys goes missing. It is the same gap we describe in WordPress needs someone accountable: the plugin does its job quietly, and nobody is assigned to ask what else it can do. Managed operations exist for exactly this kind of morning, when something outside your control breaks and you need a person, not a support queue.
Sources
This post is based on reporting from Patchstack and the original technical analysis by Nethemba. This is a developing situation, so details have already changed since this post was first published on October 19 and may change again. Updated October 22 with TeamUpdraft's statement on the breach and the fixed plugin versions, and October 23 with its guidance for Vault and Clone users, October 27 with the 1.26.14 release, and October 30 with TeamUpdraft's October 29 notice update. Source: TeamUpdraft and the UpdraftPlus changelog on WordPress.org.
