Let's build a website that works as hard as you do.
Get a fast, SEO-ready WordPress website built around your business, not a template.
Two days after Rank Math disclosed malware in some PRO downloads, another trusted WordPress tool became a way in. This time it was not a plugin update but a connection: UpdraftCentral, the remote-management service from the makers of the UpdraftPlus backup plugin. Its maker, TeamUpdraft, says “we identified unauthorised access to the teamupdraft.com website” over the weekend of 17–18 October, and “We believe our customer database was accessed.”[2] That database held UpdraftCentral connection keys, and Patchstack reports an attacker using stolen keys to install backdoor plugins on connected sites.[1] If your site runs UpdraftPlus, check it today.
What happened
UpdraftPlus is a backup plugin with “over four million active installations”, and every copy contains the client for UpdraftCentral, which lets a dashboard send commands to the site.[1] Patchstack says an attacker holding valid dashboard keys sent signed commands that installed and activated a plugin on connected sites, and that each of those plugins was a backdoor. Its telemetry recorded installations between 18 October 15:32 and 19 October 09:23.[1]
The key point is in Patchstack’s own words: “This is not a vulnerability in UpdraftPlus, and as of 19 October no plugin update stops it.” Because the commands were signed with genuine keys, every check in the plugin passed. “The fix is to delete your UpdraftCentral keys.”[1]
TeamUpdraft says “The UpdraftPlus plugin itself and its downloads were not affected” and “Self-hosted UpdraftCentral is not affected.” It is preparing an emergency release that will disconnect every UpdraftCentral connection made before 22:00 BST on 18 October.[2] Patchstack credits the security firm Nethemba, which found the attack on its own sites and published the first analysis.[1]
Update, 20 October: that release is out. UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium) automatically disconnect UpdraftCentral connections created before 21:00 UTC on 18 October. Wordfence also describes a second, working version of the backdoor that can hide an administrator from the Users screen, or log the attacker in as the first existing administrator without creating any account, “in which case the plugin file and web-server access log may be the only remaining evidence.”[3]
Why sites that never “used” UpdraftCentral can still be exposed
Patchstack found two ways a site gets an UpdraftCentral key: connecting it to a dashboard, or connecting a TeamUpdraft.com account, which “happens by default” because the “Add this website to UpdraftCentral” box comes ticked. That is why it says: “Run this check even if you have never used UpdraftCentral.”[1]
The backdoor is also built to be missed. According to Patchstack, it creates an account that shows as an Editor but is quietly given the rights to change settings and install plugins, then logs the attacker in by setting a cookie directly, which skips the login form, two-factor authentication and login limits. The account stays after the plugin is removed.[1]
What we checked on 19 and 20 October
We ran a read-only check, changing nothing, on the 11 WordPress sites we can log in to, including our own, and looked for the plugin files on 22 more WordPress sites on servers we run.
| What we checked | Result |
|---|---|
| UpdraftPlus installed, 11 sites we log in to | None |
UpdraftCentral keys (updraft_central_localkeys) | None on any of the 11 |
| Backdoor plugins: Patchstack’s description line, “Site Health Cache” and other listed names, including must-use plugins | None found |
Editor accounts holding settings or plugin-install rights; @example.org or “Site Tools” accounts; _sync_token options | None found |
| Plugin folders changed since 18 October | One site had a batch of routine plugin updates to current versions; no unknown plugins |
| UpdraftPlus plugin file, 22 more sites on our servers (checked from outside) | Not present on any of them |
Re-check on 20 October, 11 sites, against Wordfence’s indicators: listed plugin names and file hashes, the hidden-login code pattern in plugins, must-use plugins and drop-ins, and @example.com or @example.org accounts with admin rights | None found |
| Administrators counted straight from the database vs. as WordPress lists them (a hidden administrator makes these differ) | The same on all 11 |
On the sites we spot-checked on our servers, backups are taken by the hosting platform itself every 12 hours, not by a plugin with a cloud connection. It is the same point we made about the Rank Math PRO incident on 18 October: have a backup from before the bad day, kept somewhere the attacker can’t reach through the site. Three days later a bigger problem arrived underneath WordPress itself: the PHP2Shell flaws in PHP, which no plugin update can fix.
Our view: every remote connection is a key to your site
Remote management is useful. We use it ourselves to look after client sites. But each connection that can install a plugin is a key, and this week showed what happens when keys are stored somewhere you do not control. Our rule is simple: know every service that can install code on a site, keep that list short, and be able to cut any connection in minutes. Patchstack makes the same point in practical terms: on one site it analysed, creating the key under an account without the right to install plugins “stopped the attack”.[1]
Whoever runs a site, whether that is its owner, its developer or its host, needs to know what is connected to it. We made the same point in our guide to managed vs unmanaged hosting.
What not to do
- Don’t just remove the site from the UpdraftCentral dashboard. Patchstack: “Removing the site from the UpdraftCentral dashboard is not enough – the key that matters lives on the site.”[1]
- Don’t treat the update as the whole fix. UpdraftPlus 1.26.12 and 2.26.12 disconnect old connections, but Wordfence notes the update “does not remove anything an attacker may already have installed”.[3]
- Don’t fix a plugin that crashes your site with an error you don’t recognise. Patchstack warns: “Do not repair such a plugin – fixing the error switches the backdoor on. Remove it.”[1]
- Don’t only check your administrators. The backdoor account appears as an Editor.[1] And don’t rely on the Users screen alone: Wordfence warns that “once malicious PHP has executed, the WordPress dashboard is not an independent source of truth.”[3]
Check it yourself
- Is UpdraftPlus installed? In WordPress, go to Plugins and search for UpdraftPlus. If it isn’t there, this incident does not reach your site.
- Update UpdraftPlus to 1.26.12 (free) or 2.26.12 (Premium), logged in to the site’s own dashboard rather than through UpdraftCentral, as Wordfence advises.[3]
- Delete any UpdraftCentral keys. Go to Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral, open “Manage existing keys” and delete every key. Backups keep working; only remote management stops.[1]
- Look for plugins you don’t recognise, including the Must-Use tab, and especially one called “Site Health Cache” or described as “Small maintenance toolkit: keeps option storage tidy.”[1]
- Check your Editors as well as your Administrators. Look for names you don’t know, an email at
@example.org, or the display name “Site Tools”.[1] - Change passwords for your administrators and your teamupdraft.com account, as TeamUpdraft advises, and if anything looks wrong, ask your host for a backup from before 17 October.[2]
Frequently asked questions
Was the UpdraftPlus plugin hacked?
No. TeamUpdraft says the UpdraftPlus plugin and its downloads were not affected. The problem is stolen UpdraftCentral connection keys, which let an attacker send commands to sites connected to UpdraftCentral.
I only use UpdraftPlus for backups. Is my site affected?
It can be. Patchstack found that connecting a TeamUpdraft.com account adds the site to UpdraftCentral by default, so a site can hold a key nobody meant to create. Check Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, and delete any keys.
Will updating UpdraftPlus fix it?
Partly. UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium), released on 19 October 2026, disconnect UpdraftCentral connections created before 21:00 UTC on 18 October. They do not remove anything an attacker already installed, so still check the site for unknown plugins and accounts.
If you think your site is affected
We are a web design and SEO studio, not a cybersecurity firm, and we don’t offer security investigations or malware clean-up as a service. If you think your site is affected, contact your hosting provider and, for a plugin problem, the plugin’s maker first. If your site may have been hacked, use a specialist security service; the sources listed below explain what they will look for.
What we write here is what we check on the websites we build and host for our own clients. If you are planning a new website, or want a second opinion on your current site’s design and SEO, request a free written review.
References
- Patchstack (Dave Jong), “Stolen UpdraftCentral Keys Are Backdooring WordPress Sites”, 19 October 2026. Accessed 19 October 2026.
- TeamUpdraft (Joe Whittaker), “TeamUpdraft security incident: What customers need to know”, 19 October 2026. Accessed 19 October 2026.
- Wordfence (Alex Thomas), “PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites”, 19 October 2026. Accessed 20 October 2026.
- Total Web Solutions records: read-only UpdraftCentral indicator check of the 11 WordPress sites we can log in to, and a public plugin-file check of 22 more sites on our servers, 19 October 2026; re-check of the 11 sites against Wordfence’s indicators, 20 October 2026.
