UpdraftCentral keys stolen to plant malicious plugins: update UpdraftPlus and check

On October 19, 2026, TeamUpdraft, the maker of the UpdraftPlus backup plugin, disclosed that its teamupdraft.com website was accessed without authorisation over the weekend of October 17 and 18. The customer database that was accessed contained connection keys for UpdraftCentral, its remote management service, as well as for UpdraftVault and UpdraftClone.

The attacker used those keys to send commands to connected WordPress sites, creating administrator accounts and installing malicious plugins. Because the commands were signed with genuine keys, even sites running a recent UpdraftPlus version accepted them. This was not a flaw in the backup feature itself.

TeamUpdraft then released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which disconnect UpdraftCentral connections created before the incident. TeamUpdraft says WordPress.org has pushed this update to all users. If your site has updated since then, the old connections should be cut, but check the version and look for signs of intrusion.

Who is affected

• Sites connected to TeamUpdraft's cloud-hosted UpdraftCentral service. These are the most at risk.
• UpdraftVault and UpdraftClone users, whose connections were reset.
• Anyone with a teamupdraft.com account, whose details may have been exposed.
• UpdraftPlus Premium users: TeamUpdraft asks them to check their sites for unusual activity, even if they never used UpdraftCentral.
• Sites using only the free UpdraftPlus plugin, never connected to UpdraftCentral, do not need to take action according to TeamUpdraft, beyond keeping it up to date.

How to check your site

1. In WordPress, open Plugins and find UpdraftPlus. Check that the version is 1.26.13 or later (free) or 2.26.13 or later (Premium).
2. Open Users and look for administrators you do not recognise.
3. In Plugins, look for any plugin you did not install.
4. If you are not sure whether the site was linked to UpdraftCentral, ask your developer or agency.

What to do now

1. Update UpdraftPlus to the latest version.
2. If you find an unknown administrator or plugin, treat the site as compromised: have it cleaned by your host or a security professional, then change all passwords.
3. If you have a teamupdraft.com account, change its password, change it anywhere else you reused it, and reset its two-factor authentication.
4. If the site was managed through UpdraftCentral, reconnect your remote backup storage and change its access keys, as TeamUpdraft recommends.
5. UpdraftVault users need to reconnect their sites with new credentials.

This alert reports what the sources listed below published and is not a guarantee about any specific site.