Stolen UpdraftPlus keys used to plant backdoors on WordPress sites

TeamUpdraft, the developer behind UpdraftPlus — the most widely used backup plugin in the WordPress ecosystem — has confirmed that its website was compromised on 17-18 October 2026 and that its customer database was likely accessed. That database held more than customer records: it also contained UpdraftCentral connection keys, the credentials used to manage sites remotely. Overnight on 18-19 October, the attacker used those keys to send instructions to connected sites that looked like legitimate management commands.

Those instructions told the sites to install malicious plugins. Security firm Patchstack identified 99 randomly generated plugin names, all carrying the same description, "Small maintenance toolkit: keeps option storage tidy". Some, such as "Site Health Cache", were dressed up as maintenance utilities. The plugin creates a user with the Editor role and then grants that account administrator-level capabilities. In the user list it looks like an ordinary editor, but it functions as a backdoor that bypasses the normal login screen, two-factor authentication and login attempt limits.

Who is actually affected

• Only sites with an active UpdraftCentral Cloud connection. Having the plugin installed is not enough on its own, and self-hosted UpdraftCentral installations are out of scope.
• Both the free and the premium versions were affected.
• Many site owners were not aware a connection existed at all, because remote management was enabled by default when a site was linked to a TeamUpdraft account.
• Researchers at Nethemba estimate that up to 400,000 sites hold an UpdraftCentral key. How many actually received a backdoor has not been disclosed.

TeamUpdraft shipped fixed releases on 19 October: UpdraftPlus 1.26.13 for the free version and 2.26.13 for premium. The update revokes old UpdraftCentral keys and disconnects affected sites. The important caveat is this: updating does not remove a malicious plugin or an administrator account that was already created. "We patched it, so we're fine" does not hold here.

Most corporate websites in Turkey run on WordPress, and for many companies the site is the least-monitored IT asset they own. When that site sits on the same server as quote requests submitted through a form, job applications and customer contact records, a backdoor stops being a defacement risk and becomes a data breach. According to Search Engine Journal, UpdraftPlus is in use on more than 3 million sites — a plugin that turns up constantly in agency and hosting portfolios here as well.

What Kamer Bilişim recommends

• Clear the key, then update. Upgrade to 1.26.13 / 2.26.13 or later, then delete any remaining connection keys under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. Removing the site from the dashboard is not sufficient.
• Review users and plugins by hand. Look for accounts added after 17 October — particularly Editor accounts carrying administrator capabilities — and for plugins you do not recognise. If you find an unauthorised account, consider restoring from a backup taken before 17 October and change every administrator password.
• Bring the website into your maintenance scope. Backup and update plugins run with the highest privileges on the server, which is exactly why supply-chain attacks start there. A plugin inventory, version tracking and an independent off-site backup matter as much for the public website as they do for the file server.

We can go through your corporate site with you: which plugins it runs, whether this incident touched it, and whether your backups are genuinely restorable. We work on site across the Anatolian side of Istanbul and remotely elsewhere. To arrange that, use our contact page.

Source: Search Engine Journal, 21 October 2026; findings from Patchstack and Nethemba; TeamUpdraft incident notice.