TeamUpdraft breach exposes UpdraftCentral keys to takeover

TeamUpdraft — maker of the UpdraftPlus WordPress backup plugin, installed on millions of sites — says an attacker gained unauthorised access to teamupdraft.com over the weekend of 17–18 October 2026 and reached its customer database. The exposed data includes the UpdraftCentral connection keys that let the service push commands to linked WordPress sites, which means a stolen key can be used to install and activate a malicious plugin on a connected site. If you manage WordPress sites through UpdraftCentral, the work is per-site and it is today.

The primary source is TeamUpdraft's own notice, security incident: what customers need to know, posted 19 October and last updated 20 October. BleepingComputer first reported the keys being used to backdoor sites.

What was accessed

Per TeamUpdraft, the customer database held names, email addresses, billing addresses, order history, hashed passwords, two-factor settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. No card data was stored (payments run through Stripe and PayPal). Critically:

• The UpdraftPlus plugin and its download packages were not altered. This is not a poisoned-update supply-chain attack — the plugin code is intact.
• Self-hosted UpdraftCentral is not affected — only the hosted (cloud) service keys were in the breached database.
• Backups in your own remote storage (Google Drive, Dropbox, S3) were not touched.

The danger is narrow but real: an UpdraftCentral connection key is a standing remote-control credential for a site. With it, an attacker can do what the service does — including uploading and enabling a plugin, which is game over for the site.

The fix has a gap — read the version carefully

TeamUpdraft pushed emergency releases that automatically disconnect every UpdraftCentral connection made before 22:00 BST on 18 October, so the leaked keys stop working. But its own notice is inconsistent on which build does the revocation — it credits both the 1.26.12/2.26.12 and the 1.26.13/2.26.13 releases in different sections, and the update note says the keys were revoked by 1.26.13/2.26.13, published just after 22:00 BST on 19 October. Run 1.26.13 (Free) or 2.26.13 (Premium), or later — do not assume the first emergency build fully cleared the keys. And note the limit TeamUpdraft states plainly: deleting a key stops future commands but does not undo anything an attacker already did.

Action checklist

For every account holder:

1. Change your teamupdraft.com password — type the address directly, do not follow an email link — and change it anywhere you reused it.
2. Reset two-factor authentication under My Account if you use it.
3. Treat any email claiming to be TeamUpdraft with suspicion; the company says it will never ask for passwords or keys.

For each UpdraftCentral-managed site, logging in to the site's own WordPress dashboard (not via UpdraftCentral):

4. Update UpdraftPlus to 1.26.13 / 2.26.13 or later.
5. Delete the connection key under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral.
6. Under Users, remove any administrator you do not recognise; under Plugins (including the Must-Use tab), remove anything unexpected.
7. Change the passwords on all administrator accounts.
8. If anything looks wrong, restore from a backup taken before 17 October, then reconnect to UpdraftCentral.
9. Re-authorise remote storage and rotate storage access keys as a precaution. UpdraftVault and UpdraftClone users must reconnect — old Vault connections and Clone keys no longer work.

Do this for every site, including ones you rarely touch.

Context

This is a vendor-account compromise, not a plugin-code compromise — the opposite end of the WordPress supply-chain spectrum from the Rank Math Pro backdoor we covered, where the malicious code shipped in the package itself. The common thread is that WordPress's plugin ecosystem concentrates remote-control credentials in a handful of vendors, and a breach of any one of them cascades to every site that trusted it. A connection key is a password you forgot you had.