The UpdraftPlus Breach Used Keys Nobody Remembered Issuing. An Agency Holds Hundreds of Them.

01 What TeamUpdraft and the researchers have confirmed

TeamUpdraft makes UpdraftPlus, the backup plugin that passed four million active WordPress installations this month [ CSO Online, 21 Oct 2026 ] . It also runs UpdraftCentral, a dashboard that lets one person update, back up and manage many WordPress sites from one screen. Agencies and freelancers use it for exactly that.

The public record, six days in, comes from the vendor and three research teams. Where they disagree, we say so.

TeamUpdraft says the customer database holds names, email and billing addresses, order history, hashed account passwords, two-factor settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. “We do not store any card details,” it says. The plugin itself and its downloads were not touched, and self-hosted UpdraftCentral is out of scope. The company reported the incident to the ICO and other authorities, including the police [ TeamUpdraft notice ] .

Nobody has published a count of compromised sites. TeamUpdraft estimated that fewer than 10% of UpdraftPlus users have an UpdraftCentral or Migrator key. BleepingComputer and Nethemba turn that into up to around 400,000 sites exposed [ BleepingComputer, 20 Oct 2026 ] . That is the size of the door. Nethemba says it does not know how many sites the attacker walked through [ Nethemba ] .

02 A key that never expired, on a box ticked by default

The mechanism is short. Every backdoor arrived through one command, plugin.upload_plugin, which installs and activates a plugin. The attacker sent it as an ordinary signed POST request over the plugin’s own remote channel [ Patchstack ] . To the WordPress site, the request looked like its administrator’s dashboard doing routine work. In the security sense, it was.

Patchstack put it plainly: “This is not a vulnerability in UpdraftPlus.” Two design choices did the work. Keys do not expire, and the box that adds a site to UpdraftCentral when you connect a TeamUpdraft.com account is ticked by default [ Prostack, 19 Oct 2026 ] . So a site set up in 2023 by a developer who has since left the agency still answers to that key today. Nobody on the current team remembers issuing it. The attacker had it anyway.

Some variants hide from the standard plugin list. Prostack found the plugin on the Must-Use tab with the description “Small maintenance toolkit: keeps option storage tidy.” Some copies throw HTTP 500 errors on uncached pages. Patchstack warns: “Do not repair such a plugin – fixing the error switches the backdoor on. Remove it.” [ Patchstack ]

03 The first fix deleted nothing

TeamUpdraft shipped 1.26.12 and 2.26.12 on 19 October to delete the old UpdraftCentral Cloud keys. Nethemba read the code. “Because of a bug it deletes no key at all,” its analysis says. The vendor corrected it the same evening in 1.26.13 and 2.26.13 [ Nethemba ] . Any site that updated once on the Monday and stopped there was still holding the stolen key.

The corrected release has its own gap. Nethemba says 1.26.13 deletes keys created before 12:07 UTC on 18 October. Keys created that day between 12:07 and 21:00 UTC stay on the site. Nethemba’s instruction is to delete those keys by hand. As of 22 October, it noted, the vendor’s own steps still named 1.26.12 [ Nethemba ] .

Then there is what updating cannot touch. Revoking a key stops new commands. It removes no plugin the attacker already installed, no account it created and no session already open [ CSO Online ] . Prostack adds that deleting the plugin leaves its accounts in place [ Prostack ] . On 21 October, between 07:10 and 09:21 UTC, the attacker sent UpdraftCentral commands from 43.250.53.42 to two of Nethemba’s sites, after the fixed release was out. Nethemba’s own blocking plugin stopped them, and the keys were already gone [ Nethemba ] . On a site where the key was still present, the same commands would have run.

This is the same lesson the N-able N-central exploits taught MSPs in August. The vendor said then that its hotfix closed the way in and left anyone already inside where they were. We wrote that up in RMM security: when the tool is the way in. A patch is a door closing. It tells you nothing about who came through while it was open.

04 What to check on every connected WordPress site

These steps come from TeamUpdraft, Patchstack, Nethemba and Prostack. Run them on every site you manage that ever had UpdraftPlus, including sites you believe were never connected. Patchstack says to run the key check even if you never used UpdraftCentral [ Patchstack ] .

1. Find the key. Run wp option get updraft_central_localkeys. Any output means a key exists. Prostack’s guidance is that removing a site from the UpdraftCentral dashboard is not enough. The key lives on the site [ Prostack ] .
2. Delete the key before anything else. In wp-admin go to Settings, UpdraftPlus, Advanced Tools, UpdraftCentral, and delete every key under Manage existing keys. Do this first on a compromised site, so the attacker cannot push a replacement backdoor while you clean up.
3. Update to 1.26.13 or 2.26.13 or later. Never stop at 1.26.12. Sites on 1.26.4 or older also carry CVE-2026-10795, which let an attacker forge UpdraftCentral commands without any key [ Prostack ] .
4. Audit the users. Look for Administrators or Editors you cannot name, the display name “Site Tools”, two-word-two-digit usernames and @example.org or @example.com addresses. Check Editors for the manage_options capability. A clean list proves nothing, because the third variant uses an existing admin.
5. Audit the plugins, including Must-Use. Search for the “Small maintenance toolkit” description and for “Site Health Cache”. Do not delete a suspect plugin from wp-admin. Prostack says its uninstall routine wipes the evidence. Patchstack’s advice is to deactivate it, move it out of the web root, then remove the _sync_token option and the account.
6. Compare the files. Check core, theme and plugin files against clean copies. Nethemba publishes a read-only WP-CLI script, now at version 10, that checks for all three variants.
7. If anything turns up, restore and rotate. Restore from a backup taken before 17 October. Change every administrator password, log out every session and turn on two-factor authentication. Change the TeamUpdraft.com password and any reuse of it. TeamUpdraft also tells UpdraftCentral users to re-authorise remote storage and change storage access keys, and UpdraftVault users to reconnect each site and run a manual backup [ TeamUpdraft notice ] .

One more thing for UK agencies. If a client site was entered, the attacker had administrator access to a site that holds personal data: enquiry forms, customer accounts, newsletter lists. Your client is the controller, and UK GDPR gives them 72 hours from awareness to decide whether to report to the ICO [ UK GDPR, Art. 33 ] . Tell them what you found the day you find it.

05 Every remote-management key is a standing login

An agency that manages 80 WordPress sites from one dashboard has 80 keys sitting somewhere outside its own walls. Each one is an administrator login with no password prompt, no two-factor step and no expiry date. In this case the keys sat in a vendor’s customer database. The agency never saw the breach. It found out when TeamUpdraft posted a notice.

Nethemba heard from one administrator managing about 145 sites who found the second variant on two of the three sites hit [ Nethemba ] . That is the shape of the risk for anyone selling WordPress care plans. The attacker picks your dashboard, and your clients come with it.

UpdraftCentral is one tool. Most agencies run three or four that hold the same kind of access: a backup service, an update manager, a migration tool, an uptime monitor with a login, a hosting control panel. Prostack ends its advice with the step most people skip: review every other remote-management tool and disconnect the ones you do not use [ Prostack ] . Patchstack adds that if you need remote management, create the key under an account without the right to install plugins [ Patchstack ] .

Four changes turn this week’s clean-up into a standing control.

• Keep a register of keys. For every client site, list each tool that holds a key or token to it, who issued it, when and under which account. If you cannot fill a row, delete the key and reissue it.
• Give keys the least power that works. A backup tool needs to read and write backups. It does not need to install plugins. Where a tool allows a lower-privileged account, use it.
• Expire what does not expire. Rotate remote-management keys on a schedule, and every time a developer or contractor leaves.
• Watch for the commands. New plugins, new admin accounts and new Must-Use files on a client site should raise an alert to a person within the hour. Nethemba saw this attack because it was watching its own sites.

TeamUpdraft will publish more as its investigation runs, and some detail here will change. The question for your agency will not. If the vendor behind your remote dashboard posts a breach notice tomorrow morning, how many client sites would you need to check by hand, and how long would it take you to find them all?