An intruder who got into teamupdraft.com over the weekend of 17-18 October walked away with the cloud keys that let UpdraftCentral issue commands to customers’ WordPress sites. Within hours those keys were being used to plant backdoor plugins and hidden administrator accounts, turning a vendor breach into a supply-chain compromise of its customers.
What happened
TeamUpdraft, the UK-based developer behind the UpdraftPlus backup plugin (more than four million active installations), has confirmed unauthorised access to its teamupdraft.com website across 17 and 18 October 2026. The company believes its customer database was reached. That database holds contact and billing details, order history, hashed passwords, two-factor settings and, most importantly, the connection keys behind UpdraftCentral’s cloud dashboard, UpdraftVault and UpdraftClone. No card data is held, and the vendor says plugin code and downloads were unaffected.
The stolen keys did not sit idle. Slovak penetration testing firm Nethemba spotted the attack on its own sites in the early hours of 19 October, and telemetry from WordPress security company Patchstack recorded backdoor installations across a wide set of sites between 15:32 UTC on 18 October and 09:23 UTC on 19 October, logging 99 distinct malicious plugin names. BleepingComputer, citing an estimate that around 10% of UpdraftPlus sites carry an UpdraftCentral or Migrator key, puts potential exposure at roughly 400,000 websites.
TeamUpdraft says it closed the access route, signed every user out, replaced UpdraftVault credentials and UpdraftClone keys, brought in an external cyber security firm and notified both the police and the Information Commissioner’s Office. It also shipped UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) on the evening of 19 October to revoke the old cloud connection keys, after an earlier 1.26.12 / 2.26.12 release which, according to Nethemba’s code review, failed to delete any keys because of a bug.
The technical picture
Every copy of UpdraftPlus ships with a dormant UpdraftCentral client. Once a site is given a key, it trusts any instruction signed with the dashboard’s private key, running it with the permissions of whoever made the connection. No one approves individual commands. Those private keys are generated and held by TeamUpdraft’s cloud service, so the security of every connected site rested on them never leaving the vendor.
Once they did, the attacker needed no vulnerability at all. Nethemba’s sites were running WordPress 7.1.3 and the then-current UpdraftPlus 2.26.11, yet a correctly signed plugin.upload_plugin command was accepted and WordPress installed the payload through its normal installer. Patchstack is blunt that this is “not a vulnerability in UpdraftPlus”: from the site’s perspective, the instruction was legitimate.
The payloads are backdoor plugins posing as maintenance or optimisation tools. Early samples were meant to create an account dressed up as an Editor but quietly granted the ability to install plugins and change settings. A coding error instead crashed sites with HTTP 500 errors, which is how many victims noticed. Later working variants create a full administrator account or simply log the attacker in as an existing administrator using a cookie, sidestepping two-factor authentication and login throttling. Nethemba says at least one sample conceals itself from the wp-admin plugin list.
A quieter design choice widened the blast radius. When a user signs in to a teamupdraft.com account from inside the plugin, a box to add the site to UpdraftCentral is ticked by default, so plenty of owners hold a key without ever knowingly using the service. Patchstack notes keys do not expire.
Why it matters for UK organisations
UpdraftPlus is a staple of the UK small business and agency market, and this is a UK vendor that has reported to the ICO. Customers whose own sites were backdoored should not assume the vendor’s notification covers them. If an attacker created accounts on your site or could reach personal data held there, such as contact form submissions, WooCommerce orders or membership records, you need to assess whether that is a reportable personal data breach in its own right, with the 72-hour clock running from when you became aware.
Agencies are the most exposed group: UpdraftCentral exists to manage many sites from one place, so one agency account may tie dozens of client sites to the same trust chain.
There is also a timing point. TeamUpdraft says the access route is closed, but Nethemba recorded the attacker issuing fresh UpdraftCentral commands as late as the morning of 21 October. Leaked keys keep working on any site that has not updated or deleted them by hand. Nethemba also reports that 1.26.13 leaves untouched any key generated from 12:07 to 21:00 UTC on 18 October.
It is worth separating this from the Rank Math PRO incident we reported on 20 October. That was a tampered update; here the plugin code is clean and the abuse arrives through a trusted management channel. Either way, your estate inherits the security of every vendor able to push code into it.
Expert view
In my experience, remote management channels are among the least scrutinised trust relationships in a web estate. Organisations lock down SSH, then leave a plugin holding standing, non-expiring authority to install code. When we test WordPress environments, we rarely find anyone who knows which sites hold such keys, which is exactly the gap this attacker exploited.
TeamUpdraft suggests the pace of exploitation and the initially faulty plugins point to an AI-assisted attack. That is the vendor’s assessment and has not been independently confirmed, but it should not distract from the core failure: high-value signing keys stored somewhere a website breach could reach them.
The point I would stress most: removing the plugin is not remediation. The backdoor accounts outlive it, and the attacker knows their passwords.
What to do now
- Update every site to UpdraftPlus 1.26.13 / 2.26.13 at minimum, skipping 1.26.12. Confirm the version on each site (Cyber Essentials: security update management).
- Delete UpdraftCentral keys by hand on each site via Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, even on sites you believe never used the service.
- Hunt for indicators. Check for unfamiliar plugins (including must-use plugins), Editor accounts with extra capabilities, @example.org or @example.com addresses, the display name “Site Tools”, and access log requests from UpdraftCentral without a library version. Use the published IoCs and Nethemba’s script, as some backdoors hide from wp-admin.
- If anything is found, treat the site as compromised. Restore from a backup taken before 17 October, review all privileged users, rotate administrator passwords, end sessions and re-authorise remote backup storage (Cyber Essentials: user access control).
- Secure the vendor account. Change your teamupdraft.com password, change it anywhere it was reused, reset two-factor authentication and treat emails claiming to be from TeamUpdraft with caution.
- Reduce standing privilege. If you reconnect UpdraftCentral, create the key under an account without plugin installation rights, and consider making the plugins directory unwritable by PHP (Cyber Essentials: secure configuration).
- Assess your own reporting duty to the ICO and inform affected clients if you are an agency.
Bottom line
This was a vendor breach that became a customer breach the moment signing keys left the building. Patching UpdraftPlus closes the door, but it does not tell you who already walked through it. Check every site, assume any hit means full compromise, and audit which third parties hold standing authority over your web estate.
Sources
- TeamUpdraft: Security incident on teamupdraft.com: what happened, what we’ve done, and what you need to do
- Nethemba: Critical security problem in UpdraftCentral: an attacker holding the service’s keys planted a backdoor on our websites
- Patchstack: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
- BleepingComputer: Stolen UpdraftCentral keys used to backdoor WordPress sites
- The Hacker News: Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
