Vieilles clés et plaques de serrure sur un mur blanc, illustrant le vol des clés UpdraftCentral

Stolen UpdraftCentral keys: the backdoor hiding in your WordPress site

Does your WordPress site run its backups with UpdraftPlus? It’s WordPress’s most widely used backup plugin, with more than four million active installations. Over the weekend of October 17 and 18, its developer, TeamUpdraft, was breached. Among the stolen data: the connection keys for UpdraftCentral, its remote site management service.

Those keys can send commands to a WordPress site without a password. According to Patchstack, attackers used them from October 18 (11:32 a.m. EDT) to October 19 (5:23 a.m. EDT) to install backdoors on connected sites, with correctly signed commands: from the site’s point of view, everything looked legitimate. The most worrying part is what you don’t see in your dashboard.

UpdraftCentral: what you see, and what is really happening

What you see in WordPress

What is really happening

No new administrator in the list.

Users

The added account shows as a plain “Editor”, but it was granted the right to install plugins and change settings.

A plugin with a dull name, like “Site Health Cache”, or nothing at all.

Plugins

One variant removes itself from the plugin list: it is active, but invisible in the dashboard.

Your two-factor authentication is on.

Login

The attacker is logged in directly with a cookie: the login form, and therefore two-factor authentication, never runs.

You delete the suspicious plugin.

Clean-up

The account it created stays in WordPress, and the attacker knows its password.

The site shows a 500 error.

Symptom

An early version had a coding error. “Fixing” it would switch the backdoor on: remove it instead.

Patchstack counted 99 different malicious plugin names, disguised as maintenance or optimization tools. Nethemba, the company that discovered the attack on three of its own sites, points out that they were all up to date: the attacker exploited no weakness on their side, it simply had the right keys.

The account hiding among your editors

☰ WordPress dashboard — Users (illustrative example)

Dashboard › Users › All Users

Username	Email	Displayed role	Registered
marie.admin	marie@your-business.example	Administrator	2023-04-12
editorial	editorial@your-business.example	Editor	2024-09-03
1media-staff96	…@example.org	Editor	2026-10-18
2(nothing visible)	—	—	—

What to look for

1An “editor” created on October 18 or 19, with an @example.org or @example.com address, a name made of two words plus two digits (such as data-ops43 or media-staff96, two names confirmed by Patchstack) or a display name like “Site Tools”. Other names exist.
2One variant creates no account at all: it logs the attacker in as the first existing administrator. In that case, only server logs and the files on disk reveal it.

Are you affected by the UpdraftCentral incident?

Your situation	Are you affected?	What to do
You use UpdraftPlus and once connected your site to a teamupdraft.com account	Maybe, without knowing it	According to Patchstack, the “Add this website to UpdraftCentral” box is ticked by default on that screen: a key may have been created automatically. Check.
Your site is managed remotely with UpdraftCentral (cloud version)	Yes	Follow the one-hour check below today, site by site.
You have UpdraftPlus Premium, even without UpdraftCentral	Check	On October 21, TeamUpdraft asked these customers to look for unexpected plugins and administrators.
You use self-hosted UpdraftCentral	No, according to TeamUpdraft	Update UpdraftPlus anyway.
You only use UpdraftPlus for backups, with no teamupdraft.com account	Unlikely	Check the version and that no key exists: two minutes.
Your site is not on WordPress	No	Nothing to do for this incident.

☑️ A key created without your knowledge

Here’s the surprising detail: according to Patchstack, when you connect a site to your teamupdraft.com account, the “Add this website to UpdraftCentral” box is already ticked. Many small business owners who only use UpdraftPlus for backups therefore have an active key. And those keys don’t expire: keys created in November 2025 still worked in October 2026.

The one-hour check, site by site

⏱️

0–10 min

Update and cut the link

Log in to the site’s own dashboard, not through UpdraftCentral.
Make sure UpdraftPlus is on version 1.26.13 (free) or 2.26.13 (Premium) or later. Nethemba reports that a bug prevented 1.26.12 from removing the keys.
Settings › UpdraftPlus › Advanced Tools › UpdraftCentral › manage existing keys: delete every key.

⏱️

10–25 min

Look for accounts

Users: look at editors too, not just administrators.
Anyone you don’t know, or any account created on October 18 or 19, is suspicious.

⏱️

25–40 min

Look for plugins

Plugins, including the “Must-Use” tab if it appears.
Because one variant hides from the dashboard, ask your host or IT provider to search the disk for the description “Small maintenance toolkit: keeps option storage tidy.”, shared by every sample according to Patchstack.

⏱️

40–60 min

Close the other doors

Change administrator passwords and your teamupdraft.com password, and reset its two-factor authentication.
If the site was reached through UpdraftCentral: re-authorize your remote storage (Google Drive, Dropbox, S3) and change its access keys.
At the slightest doubt: restore a backup taken before October 17.

The 1.26.13 / 2.26.13 update, released on October 19 around 5 p.m. (EDT), automatically cuts old UpdraftCentral connections. It blocks new commands, but it doesn’t remove what was already installed. Patchstack also advises not to reconnect the site until the vendor explains the cause and, if you need it, to create the key with an account that cannot install plugins.

What you should have in place at the end

🧩

UpdraftPlus 1.26.13+

or 2.26.13+ (Premium)

🧩

Keys deleted

on the site itself

🧩

Accounts and plugins reviewed

editors included

🧩

Backup from before October 17

kept off the site

🛡️

Site checked

and remote management link cut until the cause is explained

Frequently asked questions

Q1. My site has shown a 500 error since October 18. Is it related?

Possibly. According to Patchstack, the first backdoor samples contained an error that crashed sites, which is how the first victims noticed the attack. Don’t try to “fix” the faulty plugin: remove it, after deleting the UpdraftCentral key, or the attacker can push a corrected version.

Q2. Is removing my site from the UpdraftCentral dashboard enough?

No. Patchstack points out that the key that matters is stored on the site itself. Delete it from the site’s own dashboard. Your backups keep working; only remote management stops.

Q3. Are my UpdraftPlus backups compromised?

TeamUpdraft says the plugin and its downloads were not affected, nor were backups sent to your own storage (Google Drive, Dropbox, Amazon S3). As a precaution, change that storage’s keys if your site was reached through UpdraftCentral.

Q4. Who is behind the attack?

That isn’t publicly known. TeamUpdraft says it notified the police and the UK data protection authority (ICO), and believes the speed of the attack suggests the attackers used AI.

It’s not the first time a trusted tool became the way in: we saw it with ConnectWise Cloud Backup’s stolen key and with the compromised OVHcloud CLI tool. If your site also runs an old PHP version, read our article on the October 21 critical PHP vulnerability.

At NeoTech, our website design service includes updates and access reviews, and our backup and disaster recovery solutions keep a copy off the site. With our cybersecurity services, automated 24/7 monitoring with on-call technician response flags new accounts and unexpected file changes.

Book your free cyber check

Not sure whether your WordPress site has an UpdraftCentral key, or who has access to it? The free cyber check starts right there: we review your site’s accounts, plugins and backups, then hand you a clear plan.

👉 Book your free cyber check

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Sources

Photo: Madison Inouye, Pexels (Pexels licence).