If your WordPress site runs UpdraftPlus and you have ever connected it to the cloud version of UpdraftCentral, or linked a TeamUpdraft account inside the plugin, treat the site as possibly tampered with and work through the steps below. TeamUpdraft, the company behind UpdraftPlus, says it found unauthorized access to teamupdraft.com over the weekend of October 17 to 18, and that connection keys for UpdraftCentral, UpdraftVault and UpdraftClone in its customer database may have been exposed. Security firm Patchstack then found attackers using genuine keys to send commands to sites and install backdoor plugins disguised as maintenance tools. This is not a flaw in the UpdraftPlus code itself, and self-hosted UpdraftCentral is not affected.
Order matters here: update UpdraftPlus and delete the UpdraftCentral key first, then look for suspicious plugins and accounts, and only then decide whether to clean up item by item or restore a backup. If you run the server, updates and backups yourself, this will take a while; if you would rather not chase every incident, you can hand that work to managed WordPress hosting, and the last section explains the difference.
Compiled from TeamUpdraft's official notice and reporting by Patchstack, BleepingComputer and The Hacker News as of October 30, 2026. Cutoff times and backdoor account names that differ between reports are left out; the official notice is the reference for details.
What happened
UpdraftPlus is a plugin many WordPress sites use for scheduled backups. UpdraftCentral is the same company's remote management service, which lets you update and back up many sites from one dashboard. Connecting a site to UpdraftCentral creates a connection key, and whoever holds that key can send the site commands, including installing plugins.
TeamUpdraft says the customer database that may have been accessed holds names, email addresses, billing addresses, order history, hashed passwords, two-factor settings and those connection keys. Researchers observed the campaign running nonstop for about 18 hours on October 18 and 19. Because the commands were signed with real keys, each one looked to the site like an action from its owner. Security researchers estimate that about one in ten UpdraftPlus sites has an UpdraftCentral or Migrator key, which could mean around 400,000 sites.
One detail means many people don't realize they are in scope: when you link a TeamUpdraft account inside UpdraftPlus, the Add this website to UpdraftCentral option is checked by default. A site can have a key even if you have never opened UpdraftCentral.
What the backdoor does
The backdoor plugin researchers analyzed hooks into every request and waits for a secret URL parameter carrying a 32-character token. When it gets one, it creates an account with a password hardcoded in the plugin, gives it the Editor role, and adds the permissions to manage site options and install plugins. It logs the attacker in by setting the login cookie directly and never touches the login form, so two-factor authentication, login attempt limits and login protection plugins don't stop it.
Patchstack has seen 99 different plugin names so far. Site Health Cache shows up most often, and every sample carries the same description: Small maintenance toolkit: keeps option storage tidy. The attacker addresses listed in the reports are 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9, worth checking if you can see your server's access logs.
Check whether your site has a key
In the WordPress admin, open the UpdraftPlus page under Settings, go to the Advanced Tools tab and click UpdraftCentral to see whether any connection keys are listed. If there are none and you have never linked a TeamUpdraft account in the plugin, the key leak doesn't reach your site; just update the plugin. If there is a key, or you aren't sure whether you ever connected one, follow the next section. Even if you only use UpdraftPlus to send backups to your own cloud drive, the check takes a minute.
Work through it in this order
- Update UpdraftPlus to the fixed version in the official notice: 1.26.13 or later for the free plugin, 2.26.13 or later for Premium. TeamUpdraft says this release automatically disconnects every UpdraftCentral connection created before the incident.
- Delete the connection key in the UpdraftCentral tab. Patchstack stresses doing this before you deal with the backdoor, or the attacker can push a fresh one.
- Review the user list for administrator or editor accounts you don't recognize, especially any that appeared after October 17. Note the username and creation time before deleting, so you can compare later.
- Review the plugin list, including the Must-Use tab. If you find a plugin you don't recognize, especially one named Site Health Cache or carrying the description above, don't delete it from the admin: Patchstack says its uninstall routine wipes its own traces. Move the plugin folder outside the web root with FTP or your host's file manager instead, and keep it for investigation.
- Change passwords. Change the WordPress administrator password, and if you found a backdoor, change the database password and the security keys in wp-config.php too. TeamUpdraft account password hashes may have leaked, so change that password anywhere else you reused it.
- TeamUpdraft recommends considering a restore from a backup taken before October 17. If you can't clean up with confidence, or you found a backdoor and aren't sure what else changed, restoring a pre-incident backup is usually more reliable than hunting item by item. Export any orders and form entries created after October 17 first, so they aren't overwritten.
If the site is already down or you can't get into the admin, bring it back first with our white screen and locked-out rescue guide, then come back to these steps.
Two habits worth changing afterwards
First, close remote management connections you don't use. UpdraftCentral and every other manage-many-sites-from-one-dashboard service is convenient, but each connection key is a key that can install plugins. Delete the ones you don't use, and check from time to time which sites are still connected to the ones you do.
Second, don't keep your backups in only one place. What was stolen this time sat on TeamUpdraft's side, and if your site's backups also live only in the same company's cloud storage, it is harder to tell which copy you can trust. Important sites should have a backup stored separately from both the plugin and the host. For everyday update and backup habits, see Afraid to update plugins? Backups, batches, rollbacks.
If you would rather not look after hosting, updates and backups yourself
This incident belongs to the same family as the Rank Math PRO backdoor in mid-October (covered in Rank Math PRO backdoored): the site did nothing wrong, and the problem came from the plugin vendor's side. If you look after your site yourself, every incident means tracking the notice, cleaning up and deciding whether to restore on your own.
RoamerHost's WP × Roamer AI gives each WordPress site its own container. Both plans include automatic backups: we keep backups of the whole site on our side, with nothing for you to set up, and if the site breaks badly or you are locked out of the admin, support helps you restore it. WordPress security updates apply automatically, and you can activate, deactivate and update plugins from the dashboard without opening the WordPress admin. On WP × Roamer AI Pro, you can also ask Roamer AI to read the error logs, deactivate the culprit plugin or roll back to a snapshot, and higher-risk actions such as deactivating plugins or restoring a backup ask for a confirmation code before anything runs. You can still install any plugin you like, including UpdraftPlus if you want an extra backup of your own; just check its connection keys as described above.
WordPress Basic is NT$3,588 a year (avg. NT$299/mo), and WP × Roamer AI Pro is NT$11,988 a year (avg. NT$999/mo). Both include hosting, SSL, automatic backups and automatic updates; compare them on our managed WordPress hosting plans and pricing. When a plugin itself is compromised, cleanup and updates still follow the plugin vendor's instructions, but our backups and support mean the restore step isn't on you alone.
Which to choose
If you have no developer and don't want to track every plugin incident and restore the site yourself, choose WP × Roamer AI Pro: a team in Taiwan looks after hosting, updates and backups, and Roamer AI can step into the site when something breaks. If you are comfortable managing plugins in the WordPress admin and only need hosting with automatic backups, choose WordPress Basic. If you want full control of the server and where backups live, self-hosting remains the option.
FAQ
Q: I only use free UpdraftPlus to send backups to a cloud drive. Do I need to do anything?
Check the UpdraftCentral tab for a connection key first. If there is none and you have never linked a TeamUpdraft account in the plugin, the key leak doesn't reach your site, so updating the plugin is enough. If there is a key, follow the steps above in order.
Q: My site uses two-factor authentication. Can it still be logged into?
Yes. This backdoor sets the login cookie directly and never touches the login form, so two-factor authentication and login protection plugins don't stop it. Look through the plugin and user lists rather than relying on login records.
Q: Is updating to 1.26.13 enough?
Not necessarily. The update disconnects pre-incident connections, but the official steps after updating still include checking for unknown administrators and plugins (Must-Use included), because anything already installed on the site has to be removed separately. If you can't be sure the site is clean, restore a backup from before October 17.
Q: Is self-hosted UpdraftCentral affected?
TeamUpdraft says self-hosted UpdraftCentral is not affected; the exposed data sat on the teamupdraft.com cloud side.
Q: Do sites hosted on RoamerHost need checking?
The automatic backups we keep of your whole site are separate from any backup plugin you install yourself. But if you added UpdraftPlus to your site and linked a TeamUpdraft account, follow the steps above all the same. If you aren't sure how to check, email our support team.
Sources
- TeamUpdraft: TeamUpdraft security incident: What customers need to know
- Patchstack: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
- BleepingComputer: Stolen UpdraftCentral keys used to backdoor WordPress sites
- The Hacker News: Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
- RoamerHost: WP × Roamer AI plans and FAQ
WordPress
