TeamUpdraft breach exposes UpdraftCentral keys that can command WordPress sites

TeamUpdraft breach exposes UpdraftCentral keys that can command WordPress sites

19 October 2026: TeamUpdraft, the company behind the UpdraftPlus backup plugin, says an intruder reached its customer database over the weekend of 17 and 18 October and took, among other things, the connection keys that let its cloud UpdraftCentral dashboard send commands to customers' WordPress sites. It has shipped UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to cut every UpdraftCentral connection made before 22:00 BST on 18 October, and it is telling cloud UpdraftCentral users to check each site by hand "today".

Not yet independently verified. TeamUpdraft has not said how many customers or sites were affected, and its own page gives the minimum safe version as both 1.26.12 and 1.26.13. Press reports of sites being backdoored with stolen keys have not been confirmed by the company. We will update this when it can be confirmed, and remove this note.

What the intruder could reach

The company's notice, posted on 19 October by Joe Whittaker, who heads its product, marketing and support function, lists what it believes was accessed:

• names, email addresses, billing addresses and order history
• account passwords, stored hashed
• two-factor authentication settings
• connection keys for UpdraftCentral, UpdraftVault and UpdraftClone

Card payments go through Stripe and PayPal, so no card data was held. TeamUpdraft says the plugin and its downloads were not touched, self-hosted UpdraftCentral is unaffected, and backups in customers' own Google Drive, Dropbox or Amazon S3 storage are safe. It has reported the incident to the UK Information Commissioner's Office. Its plugins run on what it calls "more than 5 million WordPress websites", and UpdraftPlus passed 4 million active installations this month.

Why the UpdraftCentral keys matter most

A stolen password lets someone into a teamupdraft.com account. A stolen UpdraftCentral key is different: it is the credential the dashboard uses to run backups, updates and other commands on a connected site, so in the wrong hands it is a way into the site itself. On 21 October BleepingComputer reported that stolen keys had been used to plant backdoors. TeamUpdraft's update of 20 October, written in response to such reports, says the access "was resolved" and that the plugin release "published just after 10pm BST on the 19th" revoked the keys, "blocking any access across that vector", while still urging owners to check their sites.

The release only protects sites that install it, which is the catch for agencies managing dozens or hundreds of client sites through the cloud dashboard: any site that does not auto-update stays connected on an old key until someone logs in.

The checks TeamUpdraft asks for, site by site

For each site connected to cloud UpdraftCentral, the company asks owners to log in to WordPress directly rather than through the dashboard, update UpdraftPlus, delete the UpdraftCentral key under Settings, UpdraftPlus, Advanced Tools, then look for administrator accounts and plugins they do not recognise, including on the Must-Use plugins tab, which ordinary plugin lists can hide. Admin passwords should be changed, and a site showing anything suspicious can be restored from a backup taken before 17 October. Sites that used UpdraftCentral should also re-authorise their remote storage and change storage keys.

UpdraftVault has disconnected every site, so backups stop reaching Vault until each site is reconnected with the account's new password. Every UpdraftClone client key has been replaced, which breaks any clone set up with an old key. Free plugin users without a teamupdraft.com account need do nothing beyond keeping the plugin current.

Company profile on TrustList: TeamUpdraft

Sources

• TeamUpdraft: TeamUpdraft security incident: What customers need to know (updated 20 October 16:25 BST), 19 October 2026
• BleepingComputer: Stolen UpdraftCentral keys used to backdoor WordPress sites, 21 October 2026