UpdraftPlus Security Breach: Backdoors Found on WordPress Sites
- Attackers breached TeamUpdraft's website, accessing a customer database containing sensitive connection keys.
- Compromised UpdraftCentral keys allowed hackers to bypass logins and install malicious plugins on WordPress sites.
- Over 3 million active installations were potentially exposed to unauthorized administrator account creation.
- TeamUpdraft released emergency updates (1.26.13 / 2.26.13) to revoke compromised keys and disconnect affected sites.
The WordPress ecosystem has faced a significant security crisis following a breach at TeamUpdraft, the developer of the widely used backup plugin UpdraftPlus. The incident, which unfolded over the weekend of October 17-18, 2026, highlights a critical vulnerability not in the plugin's code itself, but in the management of the keys used for remote administration. With over 3 million active installations, the scale of the potential exposure has put thousands of business owners on high alert.
The anatomy of a remote management failure
The core of the crisis lies in UpdraftCentral, a feature designed to allow administrators to manage multiple WordPress installations from a single, centralized dashboard. To facilitate this, the service uses specific connection keys that authenticate instructions sent from the remote dashboard to the connected websites. These keys essentially act as a master pass, allowing administrative actions to be performed without requiring a traditional username or password for each individual site.
During the breach of the official teamupdraft.com website, attackers gained access to the customer database. This database contained not only user details but the very connection keys that grant remote access. By stealing these keys, threat actors were able to send commands to connected WordPress sites that appeared entirely legitimate to the system. Because the commands were authenticated with valid keys, standard security protocols could not distinguish the attackers from the actual site owners.
How attackers planted backdoors
Once the attackers possessed the stolen keys, they moved quickly to establish permanent access to the target websites. According to reports from security researchers at Patchstack and findings shared on Dev.to, the hackers used the plugin.upload_plugin command to remotely install malicious plugins. These plugins were not mere nuisances; they contained backdoor mechanisms designed to grant the attackers continued access and, in some cases, the ability to create unauthorized administrator accounts.
The stealth of the attack was particularly concerning. Because the installation happened via the UpdraftCentral interface, the process bypassed the standard WordPress login screen. Independent investigations confirmed multiple instances where a single unauthorized IP address issued numerous upload commands in rapid succession, effectively hijacking the sites before the owners were aware of the breach.
Data exposure and the scope of the leak
The breach at TeamUpdraft's main site exposed a variety of sensitive information. While the company confirmed that payment card details were not stored on their servers—as transactions are handled by Stripe and PayPal—the leaked database included:
Customer names, email addresses, billing addresses, and order history. Additionally, account passwords were leaked, although TeamUpdraft noted these were stored in hashed format rather than plain text. The breach also exposed two-factor authentication (2FA) settings and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone services.
The most serious element of the case concerns UpdraftCentral, the service that allows administrators to remotely control multiple WordPress websites. The function is based on special connection keys, which allow authorized commands to be sent to connected websites.
The emergency response and technical fixes
TeamUpdraft responded by closing the unauthorized access route and signing out all accounts. To protect the user base, they released emergency updates on October 19, 2026. Version 1.26.13 for the free edition and 2.26.13 for the premium version were designed to automatically revoke and disconnect any UpdraftCentral connections established before 10 p.m. BST on October 18.
While WordPress.org pushed these updates automatically to many users, security experts warn that a simple update may not be enough for those already compromised. The revocation of keys prevents future attacks via that route, but it does not remove malicious plugins or unauthorized admin accounts that may have already been installed on the site.
Critical recovery steps for site administrators
For businesses utilizing UpdraftCentral, the recovery process requires a manual audit of the WordPress installation. Relying solely on the plugin update is insufficient if a backdoor has already been planted. The recommended security protocol includes:
Administrators should first log in directly to their WordPress dashboard—avoiding the UpdraftCentral interface—and inspect the list of administrator accounts for any unrecognized users. A thorough review of all installed plugins, including Must-Use (MU) plugins, is essential to identify and delete suspicious additions. Furthermore, it is advised to change all administrator passwords and re-authorize remote storage keys as a precaution. In severe cases, the safest route is restoring the website from a backup created prior to October 17, 2026.
Global business implications and regulatory fallout
For entrepreneurs and enterprises in the USA and UK, this incident underscores the systemic risk of centralized management tools. In the United Kingdom, TeamUpdraft has already reported the incident to the Information Commissioner's Office (ICO), acknowledging that the breach of customer data falls under the purview of strict data protection laws. For UK-based firms, this event may trigger internal audits regarding how third-party plugins handle administrative access to corporate assets.
In the United States, where the regulatory landscape is more fragmented but increasingly focused on consumer privacy and cybersecurity resilience, this breach serves as a reminder of the liability associated with supply chain attacks. When a trusted tool like UpdraftPlus becomes the vector for an attack, the responsibility for the resulting data breach often falls on the site owner under various state laws and industry standards.
Globally, this incident highlights a shift in attacker strategy. Rather than searching for a zero-day vulnerability in the software code, hackers are targeting the infrastructure of the service providers themselves. By compromising the central authority (TeamUpdraft), they gained a key to millions of doors. For the international business community, the lesson is clear: the convenience of remote, centralized management must be balanced with rigorous access controls and a zero-trust approach to third-party administrative keys.
FAQ
Was the UpdraftPlus plugin code itself hacked?
No, the plugin code and official download files were not compromised. The attack occurred because the connection keys stored in TeamUpdraft's customer database were stolen.
Does updating the plugin fix everything?
The update revokes the compromised keys to prevent new attacks, but it does not remove malicious plugins or fake admin accounts already installed by hackers. Manual inspection is required.
Was my credit card information stolen?
No, TeamUpdraft does not store payment card information; those transactions are processed externally via PayPal and Stripe.
What should I do if I used UpdraftCentral?
Log in directly to your site, update the plugin, delete existing UpdraftCentral keys, check for unauthorized admin users, and scan for suspicious plugins.
Sources: Searchenginejournal, Wordpress, Dev ·
Scrivila qui: Susanna, l assistente AI di glacom, ti risponde via email con un approfondimento gratuito.
Nessuna consulenza personalizzata (finanziaria, legale o medica): solo informazione e fonti. Email usata solo per rispondere.
oppure scrivile su: WhatsApp · Telegram · SimpleX · Delta Chat · Email
