UpdraftPlus Breach Exposed 3 Million Sites to Backdoor Attacks

By Tom Whitfield

Attackers compromised the website of UpdraftPlus, a WordPress backup plugin installed on more than 3 million websites, and used stolen connection keys to install malicious plugins and create unauthorized administrator accounts on connected sites. The intrusion required no username or password. TeamUpdraft, the plugin's developer, confirmed its website was compromised over the weekend of October 17-18, 2026.

The company believes attackers accessed its customer database, which held customer information and connection keys for services including UpdraftCentral, the remote management feature at the center of the incident. Those keys allowed attackers to take control of connected WordPress websites.

What did the vendor do?

TeamUpdraft closed the unauthorized access route, replaced the potentially compromised credentials, and released security updates that revoke older UpdraftCentral connections. The updates — UpdraftPlus 1.26.13 for the free version and 2.26.13 for the premium version — shipped on October 19, 2026, one day after the breach window.

The plugin changelog describes the updates as revoking UpdraftCentral Cloud keys, with 1.26.13 correcting how the revocation was applied in the preceding release. The updates automatically disconnect affected websites from UpdraftCentral, blocking further access through that route. TeamUpdraft also reported that WordPress.org had pushed the updated plugin to users automatically.

The takeaway: updating closes the door, but it does not clean what may already be inside.

How did stolen keys defeat the security checks?

UpdraftPlus lets WordPress owners back up, restore and migrate sites, storing copies on services such as Google Drive, Dropbox and Amazon S3. Its UpdraftCentral feature manages multiple WordPress installations from a single dashboard, using security keys to authenticate instructions sent from that dashboard to connected websites. The keys let the service perform administrative actions without a separate login to each site.

That design is what the attackers weaponized. Commands sent with the stolen keys appeared to be legitimate instructions from the remote management service, and standard security checks could not tell the difference. The websites accepted the attackers' commands as authorized.

Security company Patchstack, in an initial analysis published before TeamUpdraft released the updates, stated bluntly:

"This is not a vulnerability in UpdraftPlus, and as of 19 October no plugin update stops it. The commands are correctly encrypted and signed with genuine dashboard private keys. Every check in the plugin passes, because from the site's point of view the instruction is legitimate."

In plain words: the attackers exploited no programming error. The security checks worked as designed, and the stolen keys let attackers impersonate the management service itself.

What did the malicious plugins do?

Using the compromised keys, attackers instructed connected websites to install and activate malicious plugins through WordPress's normal installation process. The plugins contained a backdoor that could create a WordPress user account with the Editor role and then grant that account additional administrative permissions.

That combination made the accounts hard to spot. An Editor account normally cannot install plugins or manage core WordPress settings, but the malicious code granted those capabilities separately, so the unauthorized accounts could look like ordinary Editors while holding administrator-level permissions.

The backdoor also bypassed the normal WordPress login process, sidestepping two-factor authentication and login attempt restrictions.

Patchstack found a flaw in the attackers' work: a coding error caused affected websites to return server errors before the backdoor could activate. The error did not eliminate the danger. Patchstack identified 99 different names used for the malicious plugins, including one called Site Health Cache. The names generally resembled legitimate maintenance and performance tools, making them less obvious to owners reviewing installed plugins.

The takeaway: a half-broken backdoor is still a backdoor worth hunting for.

Which websites are at risk?

Not every site running UpdraftPlus. The incident affects websites with active UpdraftCentral Cloud connections — but Patchstack reported that connecting a website to a TeamUpdraft account could automatically create an UpdraftCentral connection, because the option to enable remote management was selected by default. Owners using UpdraftPlus strictly for backups could therefore hold active connection keys without knowing it.

Patchstack confirmed the issue affected both free and premium versions of the plugin. TeamUpdraft stated that self-hosted UpdraftCentral installations were not affected.

What should site owners do now?

TeamUpdraft urges website owners, including those who never knowingly used UpdraftCentral, to check for evidence of unauthorized activity. The company's recommendations:

• Review installed plugins for unfamiliar additions.
• Check WordPress user accounts for unauthorized administrators.
• Verify the site runs UpdraftPlus 1.26.13 or 2.26.13, or newer.
• Remove any remaining compromised UpdraftCentral connection keys, managed in the WordPress dashboard under Settings, UpdraftPlus, Advanced Tools, UpdraftCentral.
• Change administrator passwords.
• Consider restoring from a backup created before October 17 if evidence of compromise appears.

Users with TeamUpdraft accounts should also change their account passwords. The company says there is no current evidence that attackers retain access to its systems, but its investigation remains ongoing.

The updates block further access through the compromised connections. They do not remove malicious plugins or unauthorized accounts that may already exist. That gap is why the manual checks matter even on fully updated sites — and why the incident stands as a warning that a vendor's own infrastructure, not just its code, can become the attack surface for millions of downstream customers.