Last updated: October 19, 2026. This incident is still developing; we will update this page as TeamUpdraft publishes more.

On October 18 and 19, 2026, attackers used stolen UpdraftCentral connection keys to install backdoor plugins on WordPress sites running UpdraftPlus. If your site has an UpdraftCentral key, delete it now, then check for an unfamiliar plugin and a hidden user account. Updating the plugin alone does not protect you.

What happened

TeamUpdraft, the company behind UpdraftPlus, confirmed unauthorized access to its systems on October 18, which it believes exposed UpdraftCentral connection keys. UpdraftCentral is the remote-management service built into every UpdraftPlus install. A site with a key accepts signed commands from the UpdraftCentral dashboard, including "install this plugin".

According to Patchstack's analysis, the attacker sent signed plugin.upload_plugin commands to connected sites, and WordPress installed and activated a backdoor plugin. Because the commands were signed with genuine keys, the sites had no reason to reject them. Patchstack observed the first installation at 15:32 UTC on October 18 and the most recent at 09:23 UTC on October 19. Nethemba, whose own sites were hit, published a detailed analysis the same day.

Two things make this incident unusual:

  • It is not a plugin vulnerability. No update fixes it, because the keys themselves were the problem. As of October 19, the current releases (1.26.11 and 2.26.11) accept the stolen keys like any older version.
  • Many sites were connected without their owners knowing. Connecting a TeamUpdraft.com account, which UpdraftPlus Premium asks you to do, had a checkbox enrolling the site in UpdraftCentral that was ticked by default. UpdraftCentral keys also don't expire.

This is separate from CVE-2026-10795, an authentication bypass fixed in June 2026 in versions 1.26.5 and 2.26.5. If you are on an older version, you have both problems.

Step 1: Delete your UpdraftCentral keys

Do this first, from the site's own dashboard, not through UpdraftCentral:

  1. Go to Settings → UpdraftPlus → Advanced Tools → UpdraftCentral.
  2. Under the list of existing keys, delete every key.

If you have WP-CLI, wp option get updraft_central_localkeys shows whether keys exist; any output means the site was exposed. Removing a site from the UpdraftCentral dashboard does not delete the key stored on the site, so check the site itself.

Your scheduled backups keep working without the key. Leave it deleted until TeamUpdraft explains how the keys leaked and confirms it is safe to reconnect. The attacker already holds the old keys, so reconnecting with a new key under an account that cannot install plugins is the safer option when you do.

Step 2: Look for the backdoor plugin

The plugins had random, harmless-sounding names. Patchstack recorded 99 different ones, including "Site Health Cache" (the most common), "Image Core B36", "Speed Kit", "Seo Helper" and "Style Press". Victims on Reddit also reported "Image Core" with the author "StoneDock Tools". The most reliable sign is the plugin description, which Patchstack reports as: Small maintenance toolkit: keeps option storage tidy.

  • In Plugins, check both the regular list and the Must-Use tab for anything you didn't install.
  • With WP-CLI, run wp plugin list and wp plugin verify-checksums --all.
  • Search wp-content/plugins for the description text above.

Many affected sites first noticed a fatal error or HTTP 500 on every page, caused by a coding mistake in the backdoor. Don't "fix" that error; Patchstack notes that correcting it would activate the backdoor. If you find the plugin, deactivate it and move its folder outside the web root rather than deleting it from wp-admin, so you keep it as evidence.

Step 3: Look for the hidden user account

This is the step most people miss. When the attacker visits a secret URL, the backdoor creates a WordPress user, gives it the Editor role, then adds the manage_options and install_plugins capabilities. It logs the attacker in with a cookie, which bypasses the login form, two-factor authentication and login-attempt limits. The account survives after you delete the plugin, and it may not appear on the Users screen.

Known traits from Patchstack, Nethemba and victims:

  • Usernames made of two words plus two digits, such as data-ops43, media-staff96 or render_maint13 (names vary)
  • An email address at example.org
  • The display name "Site Tools"
  • A database option whose name ends in _sync_token

Check from outside the dashboard: wp user list --fields=ID,user_login,user_email,user_registered,roles, or sort the wp_users table by user_registered in phpMyAdmin. Look at every account created since October 18, not just administrators: an Editor holding manage_options is the red flag. Our guide to finding hidden admin users in WordPress walks through the database checks.

Step 4: Check your logs

Your access logs tell you whether anyone actually used the backdoor:

  • Requests from 43.250.53.42 or 2a09:bac5:4e21:2e3c::49b:9 (the attacker changes infrastructure, so absence proves little)
  • A URL parameter starting with an underscore followed by a 32-character token
  • Requests whose user agent mentions class-udrpc.php but lacks the usual version and teamupdraft.com address
  • In the UpdraftCentral log, a plugin.upload_plugin command you didn't send

Step 5: If you found anything, treat it as a full compromise

If the plugin or the account was present, or the trigger appears in your logs, assume the attacker had administrator-level access and may have left more behind:

  1. Restore from a backup taken before October 17, or follow a full cleanup: our step-by-step guide on how to fix a hacked WordPress site covers it.
  2. Remove the backdoor account and the _sync_token option.
  3. Rotate every WordPress administrator password and your TeamUpdraft.com password, and change that password anywhere else you reused it.
  4. Log out all sessions, which you can force by changing the security keys and salts in wp-config.php.
  5. Check scheduled tasks with wp cron event list and core files with wp core verify-checksums.

Patchstack also advises treating sites where the plugin was installed but never activated as affected.

Step 6: Update, then decide about remote management

Update UpdraftPlus to the latest version so you are protected from CVE-2026-10795. Then decide whether you need UpdraftCentral at all. If you do, reconnect only after TeamUpdraft confirms the cause is fixed, with a new key created under an account that does not have the install_plugins capability. That one detail stopped the attack on one site Patchstack analyzed.

Be wary of emails about this incident. TeamUpdraft says it will never ask for your password or keys; type teamupdraft.com into your browser instead of following links.

When to get help

If you manage several sites, run these checks on all of them today. If you found the plugin or the account and want the site cleaned properly, with the entry point closed and an incident report, our WordPress malware removal service handles it. To reduce the damage a single compromised tool can do next time, see WordPress hardening.

Sources: Patchstack, Nethemba, IT-Connect, and TeamUpdraft's security incident notice.