UpdraftPlus / UpdraftCentral breach (TeamUpdraft, Oct 17-18 2026): stolen UpdraftCentral connection keys used to install backdoor plugins on WordPress sites. Does updating UpdraftPlus fix it, and what must I delete?

What happened: TeamUpdraft, the company behind the UpdraftPlus backup plugin, says someone accessed teamupdraft.com over October 17-18, 2026, including its customer database: names, emails, billing details, password hashes, 2FA settings, and UpdraftCentral connection keys (card data is handled by Stripe and PayPal and wasn't stored). With those keys the attacker sent validly signed remote-management commands to WordPress sites running UpdraftPlus and installed malicious plugins, some disguised as maintenance tools, that create admin accounts and keep backdoor access. Patchstack saw installations from October 18 15:32 to at least October 19 09:23 and around 99 different backdoor plugin names. Because the commands were signed with real keys, simply updating UpdraftPlus does not undo anything already installed. Am I affected: - Your site runs UpdraftPlus (free or Premium) and was ever connected to a teamupdraft.com account or UpdraftCentral. The connect screen's 'Add this website to UpdraftCentral' box is ticked by default, so sites used only for backups can still hold a key. - Check UpdraftPlus settings, the UpdraftCentral tab, for existing connection keys; check Plugins for anything you don't recognize installed on or after October 18; check Users for new administrators. Fix: 1. Update to UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later. These revoke older UpdraftCentral Cloud connections. 2. Delete every UpdraftCentral connection key on the site by hand. Version 1.26.13 doesn't remove keys created on October 18 between 12:07 and 21:00 UTC, which is exactly when the attacker was active. Re-create a key afterwards only if you use UpdraftCentral. 3. Remove unknown plugins and admin users, change all admin passwords and reset 2FA, and change your teamupdraft.com password (and anywhere you reused it). 4. If you find a backdoor, prefer restoring files and database from a backup taken before October 17, then repeat steps 1-3, and rotate secrets in wp-config.php (database password, salts) and plugin API keys. After: scan the site with a WordPress security scanner, watch for new admins or plugins over the following weeks, and check server logs from October 17 onward for UpdraftCentral remote-command activity. Sources: https://www.csoonline.com/article/4238422/wordpress-sites-compromised-after-teamupdraft-credential-exposure.html https://www.therepository.email/attacker-uses-stolen-updraftcentral-keys-to-backdoor-wordpress-sites-after-teamupdraft-breach https://wp-umbrella.com/blog/updraftplus-backdoor-attack-what-happened-and-how-to-protect-your-sites/