TeamUpdraft, the maker of the backup plugin UpdraftPlus, updated its security incident warning on October 29, 2026: On some WordPress sites, a plugin planted by the attackers went unnoticed, and they later used it to create a new administrator account. By that point, the site had already been disconnected from UpdraftCentral.
You therefore need to check every site that was ever connected to UpdraftCentral Cloud, with both the free and the premium version of UpdraftPlus. Updating to the current version only blocks the old access. Whatever the attackers have already installed stays on the server.
What happened at TeamUpdraft?
On the weekend of October 17 to 18, unknown parties broke into the website teamupdraft.com. According to the vendor's assessment, the attackers read out the customer database: names, email and billing addresses, passwords as hash values, and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft does not store credit card data; the plugin itself and its downloads remained unchanged.
With the keys for UpdraftCentral, the tool for remotely managing multiple sites, the attackers sent commands to the connected sites. According to BleepingComputer, Patchstack counted at least 99 plugins with disguised names such as "Site Health Cache" that opened a backdoor and created accounts with full privileges. BleepingComputer estimates that one in ten sites with UpdraftPlus has a key for UpdraftCentral or the migrator, around 400,000 sites. UpdraftPlus 1.26.13 and the premium version 2.26.13 from October 19 invalidate the old keys.
Which sites do you need to check?
The deciding factor is the connection to UpdraftCentral Cloud. For the free version without an account at teamupdraft.com, the vendor sees no need for action beyond the usual update; self-hosted UpdraftCentral is not affected. If you have an account at teamupdraft.com, change your password and set up two-factor authentication again. Since October 21, the vendor has advised premium users to check their sites for foreign plugins and new admins even without UpdraftCentral.
Do you need to check your site?
Assessment based on the TeamUpdraft notice, as of October 29, 2026
How do you use UpdraftPlus?
- Site was ever connected to UpdraftCentral CloudCheck each site individually, including disconnected ones
- Premium version, without UpdraftCentralCheck site for foreign plugins and admins
- Free version without an account at teamupdraft.comJust install the usual update
- Self-hosted UpdraftCentralNot affected
Source: TeamUpdraft
How do you find hidden plugins and accounts?
Some of the plugins hide themselves in the plugin list and also conceal the created accounts in the user management. TeamUpdraft recommends these steps:
- Bring UpdraftPlus to 1.26.13 (premium: 2.26.13) or newer and, in the dashboard of the site itself under Settings › UpdraftPlus Backups › Advanced Tools › UpdraftCentral, delete all keys via "Manage existing keys".
- Go through the folders wp-content/plugins and wp-content/mu-plugins via SFTP or in your host's file manager. As disguised names, TeamUpdraft lists, for example, Asset Forge 2, Core Smith, Image Forge, Quick Pack, Seo Helper and WP Forge.
- Do not delete suspicious plugins via the dashboard, because some of them remove their traces in the process. First deactivate them, then remove the entire folder via SFTP or file manager.
- List administrators and editors without loading plugins, for example via WP-CLI with wp user list --role=administrator --skip-plugins, and watch for random-looking names such as data-ops43.
- Renew the security keys in wp-config.php so that all sessions end, and change the passwords of all genuine admin accounts.
What this means for you
Go through every site that was ever attached to UpdraftCentral Cloud, including client sites that you rarely open. Without SSH access, you can do the file check in your host's file manager. If you don't have WP-CLI, ask your host's support to output the user list with plugins switched off and to set new security keys.
If you find a foreign plugin or account, restore a backup from before October 17. You still need new keys and passwords. How updates and backups work together in WordPress is shown in the lesson on security and backups.
Afterwards, check whether you need remote management at all. Since UpdraftPlus 1.26.14 from October 26, the option to automatically add a site to UpdraftCentral when connecting is switched off by default; you now have to turn it on yourself. Change your password at teamupdraft.com via the address you typed in yourself, never via a link in an email.
TeamUpdraft updated the notice on October 29, 2026.
Sources
