Quick answer: Over the weekend of October 17 and 18, 2026, an attacker got into teamupdraft.com, the company behind UpdraftPlus (4 million+ installs), and most likely took the UpdraftCentral connection keys stored there. With those keys they sent genuine, signed commands to connected WordPress sites and installed backdoor plugins: 99 different names in about 18 hours. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later, make sure no UpdraftCentral key is left, then check Users and Plugins. The update revokes the old keys. It does not remove a backdoor that is already there.
Every security post on this blog so far has been about a bug. This one isn't. Nothing in UpdraftPlus had to break for this to work: the sites did exactly what they were built to do, which is accept instructions from a dashboard holding the right key. The key was the weakness, and it was kept somewhere you don't control.
What happened to UpdraftPlus?
UpdraftPlus is the most used backup plugin for WordPress. Every copy carries the client for UpdraftCentral, TeamUpdraft's remote management service. Connect a site with a key, and the dashboard can back it up, update it and install plugins on it without anyone logging in.
TeamUpdraft says it found unauthorized access to teamupdraft.com over the weekend of October 17 and 18. It believes the customer database was accessed. That database held names, email addresses, billing addresses, order history, hashed passwords, two-factor settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card details were not stored there.
Then the keys were used.
| When (UTC) | What happened |
|---|---|
| Oct 17 to 18 | Unauthorized access to teamupdraft.com |
| Oct 18, 15:32 | First backdoor plugin installed on a site (Patchstack) |
| Oct 19, early morning | Nethemba, a Slovak security firm, catches it on three of its own sites when one starts returning error 500 |
| Oct 19, 09:23 | Last install Patchstack observed; the campaign ran for about 18 hours |
| Oct 19, evening | UpdraftPlus 1.26.13 and 2.26.13 released and pushed through WordPress.org; they revoke the old UpdraftCentral keys |
| Oct 20 | The attacker comes back to try the triggers of backdoors that had already been removed |
The commands carried real dashboard signatures, so every check in the plugin passed and WordPress installed and activated what it was sent through its own installer. When one backdoor turned out to be broken, Nethemba saw the attacker delete it and upload a working one two seconds later. TeamUpdraft says it suspects AI tooling sped the attack up, given how fast it moved and how faulty the first backdoors were.
Why didn't two-factor authentication stop it?
Because the attacker never used the login form.
The backdoor plugin watches every request for a secret URL parameter holding a 32-character token. When it sees it, it creates an account with a hardcoded password, gives it the Editor role plus the manage_options and install_plugins capabilities, sets a "remember me" cookie valid for 14 days and sends the visitor to wp-admin. Two-factor authentication, login attempt limits and login protection plugins all sit on the login form. None of them ran.
| What it left | Why it is easy to miss |
|---|---|
| A plugin with an ordinary name | 99 names so far, like "Site Health Cache", "Asset Forge 2" or "Speed Kit". The reliable sign is the description: "Small maintenance toolkit: keeps option storage tidy." |
| An Editor who is really an admin | Shows as Editor in Users, so a look for unknown administrators skips it. Display names like "Site Tools", "System Team" or "Web Tech", emails at example.com or example.org, usernames like web.tech988 |
| A token in the database | An option whose name ends in _sync_token |
| An account that outlives the plugin | Delete the plugin and the account still logs in with its known password, unless 2FA is on for it |
| A key that still works | UpdraftCentral keys don't expire. Until the site deletes it, whoever holds it can send the next plugin |
One more detail from Patchstack: some of the backdoors have a coding error that makes the site throw error 500 on uncached pages. Fixing that error is what switches the backdoor on. If your site started failing on October 18 or 19, don't debug the plugin. Remove it.
Is my site affected?
Your site was exposed if it ran UpdraftPlus and had a connection key for TeamUpdraft's cloud UpdraftCentral service. Two things make that group bigger than it sounds:
- You may have a key without ever using UpdraftCentral. When you connect a site to a teamupdraft.com account, the box "Add this website to UpdraftCentral" is ticked by default.
- Keys don't expire. A site connected years ago and forgotten is still connected.
TeamUpdraft says the plugin itself and its downloads were not touched, and neither were self-hosted UpdraftCentral or backups in your own storage (Google Drive, Dropbox, S3). If you use the free plugin and never connected a teamupdraft.com account, it says no action is needed beyond staying updated. If you run Premium, it now asks you to look for unexpected plugins and admins even if you never used UpdraftCentral.
What should I do today?
- Log in to each site directly, not through UpdraftCentral.
- Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. WordPress.org pushed it, so most sites already have it; confirm the number. Some of TeamUpdraft's own instructions say 1.26.12, but Nethemba notes that version does not delete keys.
- Make sure no key is left. Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral, and delete every key there. With WP-CLI,
wp option get updraft_central_localkeysshould return nothing. The update only revokes keys created before a cutoff on October 18, so a key added later has to go by hand. Removing the site from the UpdraftCentral dashboard is not enough. - Check Plugins, including the Must-Use tab, for anything you didn't install, and search your plugin folders for the description line above. If you find one, delete the UpdraftCentral key first, then deactivate the plugin and move it out of the web root rather than deleting it from wp-admin. Remove the
_sync_tokenoption and the account it created. - Check Users for Editors with admin powers, not only for unknown administrators.
- Reset access. Change every administrator password, end all sessions and turn on 2FA for every account. Change your teamupdraft.com password, and anywhere else you used it.
- If a backdoor was active, or the token shows up in your access logs, treat the site as compromised. Restore from a backup taken before October 17, then rotate everything. Here is what to do in the first hour after a hack.
Also this week: a poisoned Rank Math PRO update
For about eleven hours, from 20:02 UTC on October 15 to 07:12 UTC on October 16, copies of Rank Math SEO PRO 3.0.123 downloaded from rankmath.com or delivered as updates carried a backdoor. Wordfence tracks it as CVE-2026-111862 (CVSS 9.8). It rebuilds itself when pages are visited, can create admin accounts with usernames starting wpsupport_, drops a fake core file at wp-includes/class-wp-cache-util.php, adds cron jobs and SSH keys, and may have read every secret the site could reach.
The version number won't tell you: a 3.0.123 installed before the window is clean. If yours was installed and activated during it, treat the site as compromised even if it has since moved to the clean 3.0.124. Restore a backup from before October 15, 20:02 UTC, then rotate every credential, including database passwords, the salts in wp-config.php and any API keys. The free Rank Math plugin is not named in the notice.
Also this week: PHP2Shell
On October 21, PHP shipped fixes for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), a day earlier than planned because the identifiers leaked. One unauthenticated request can trigger them before any WordPress code runs. On release day Cloudflare reported early attacks and watchTowr reported exploitation attempts, while the PHP team said it had not seen a working exploit at release.
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4 to 8.1 only got source backports, and anything older gets nothing. On most hosting this one isn't yours to patch: check your version under Tools → Site Health → Info → Server, and ask your host when you will be on a fixed build. The full story, with the version table and what each kind of hosting has to do, is in PHP2Shell: the critical flaw under every WordPress site.
What do this week's three stories have in common?
None of them was a plugin someone forgot to update. One came through a backup plugin's remote control, one through an SEO plugin's own update, and one through the language underneath them both. With Rank Math, updating promptly is what delivered the malware. With UpdraftPlus, it was the convenience set up to manage updates.
The patching advice in every other post here still stands. But a WordPress site runs code from dozens of vendors on a server that executes it on every visit, and any one of those vendors, or any one of their customer databases, can hand someone the means to install more. You can't patch your way out of another company's breach. You can only reduce the number of companies that can put code on your server. A showcase site that is built ahead of time and served as files has no plugin installer, no remote-management key and no PHP running when a visitor arrives, so this week's three stories have nothing on it to use. If that is the trade you are weighing, here is what leaving costs and what you would move to.
FAQ
Is UpdraftPlus still safe to use?
TeamUpdraft says the plugin code and its downloads were not modified, and backups in your own storage were not affected. The risk was the cloud UpdraftCentral connection. On 1.26.13 or 2.26.13 with no UpdraftCentral key on the site, the channel used in this attack is closed. Patchstack advises not reconnecting until the vendor explains the cause and, if you need remote management, connecting with an account that cannot install plugins: on one site it analysed, that alone stopped the attack.
Does updating UpdraftPlus remove the backdoor?
No. The update revokes the stolen keys so no new plugin can be sent. A backdoor plugin, the account it created and the token in your database stay where they are until you remove them.
Is there a CVE for the UpdraftCentral attack?
No. Patchstack treats it as a key compromise, not a flaw in the code. A separate, older flaw in the same channel, CVE-2026-10795 (CVSS 8.1), was fixed in June in 1.26.5 and 2.26.5 and is still being attacked, so a site on an older version faces both.
I never used UpdraftCentral. Can I ignore this?
Not until you have checked. Connecting a site to a teamupdraft.com account ticks "Add this website to UpdraftCentral" by default, so a key can exist on a site whose owner never opened the dashboard. If wp option get updraft_central_localkeys returns nothing, or the UpdraftCentral tab under Advanced Tools lists no keys, this attack had no way in.
Why didn't my security plugin catch it?
From the site's point of view, nothing unusual happened: a dashboard it trusted sent a signed command, and WordPress installed a plugin with its own installer, the same way a legitimate install works. The attacker then signed in by cookie, so login protection, attempt limits and 2FA never ran. That is why the checks above look for what was left behind rather than for a break-in.
Sources: TeamUpdraft: Security incident, what customers need to know (updated Oct 21, 2026), Patchstack: Stolen UpdraftCentral keys are backdooring WordPress sites (Oct 19, 2026), Nethemba: UpdraftCentral backdoor analysis (updated Oct 21, 2026), The Hacker News: Attackers abuse UpdraftCentral keys to plant backdoors (Oct 21, 2026), The Hacker News: Rank Math PRO hijacked to deliver self-restoring backdoor (Oct 19, 2026), Help Net Security: PHP2Shell patched (Oct 21, 2026), Tenable: PHP2Shell FAQ. Details as reported at the time of writing; this story is still developing, so check the vendor's incident page for current guidance.