UpdraftCentral key breach: check your site and remove the backdoor

Many sites were hit without their owners ever using UpdraftCentral, because the connection is switched on by default. The quickest sign: a site that suddenly shows errors on every page, and a WordPress “recovery mode” email naming a plugin you don’t know.

What happened

• The breach: teamupdraft.com was breached around 17–18 October 2026. The customer database was taken, including UpdraftCentral, UpdraftVault and UpdraftClone keys, hashed passwords and two-step login settings. No card data.
• The attack: using stolen UpdraftCentral Cloud signing keys, the attackers told connected sites to install a plugin. Patchstack saw the first install on the afternoon of 18 October and the latest on 19 October at 09:23, with 99 different plugin names. Levamo counted more than 100 sites hit.
• What the backdoor does: it watches every request for a secret code in the address. When it sees it, it creates an Editor account that is also allowed to change settings and install plugins, and logs the attacker in directly, skipping the login form and two-step login. That account stays after the plugin is removed.
• Why some sites broke: the latest batch has a bug that causes a fatal error, so every page shows an error. That is how many owners noticed.

Are you affected?

• At risk: any site with UpdraftPlus, free or premium, that has an active UpdraftCentral key.
• Not affected: sites with no key, sites connected to a self-hosted UpdraftCentral, and the UpdraftPlus plugin code itself.

To see whether your site has a key: Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys. With WP-CLI: wp option get updraft_central_localkeys.

Check your site

The free Moatline Malware Scanner (version 1.2.1 or later) does these checks for you: it finds the backdoor plugin and the “Site Tools” accounts, flags any non-administrator who can install plugins, and shows a Delete UpdraftCentral keys button on its dashboard when your site has keys. To check by hand:

1. Unknown plugins. Look in wp-content/plugins for plugins you didn’t install, with names like “Site Health Cache”, “Load Stack 35C”, “Fast Engine” or “Seo Helper”. The giveaway is the description: “Small maintenance toolkit: keeps option storage tidy.” Check over SFTP or your host’s file manager too, because a broken plugin may not show in the dashboard.
2. Unknown accounts. In Users, look for display name Site Tools or an email ending in @example.org. Usernames look like two words and two digits, such as data-ops43 or media-staff96. Check any Editor account that can reach Settings or install plugins: Editors normally can’t.
3. Logs. If your host gives you access logs, look for POST requests from 43.250.53.42 or 2a09:bac5:4e21:2e3c::49b:9. Genuine UpdraftCentral traffic carries a user agent with class-udrpc.php/2.0 and a teamupdraft.com address; the attacker’s requests don’t.

Cleanup

1. Delete the UpdraftCentral keys (Manage existing keys → Delete, or wp option delete updraft_central_localkeys). Backups keep working.
2. Delete the backdoor plugin folder over SFTP or your host’s file manager. Don’t uninstall it from the Plugins screen: its uninstall routine wipes its own traces.
3. Delete the “Site Tools” or @example.org accounts, change every administrator’s password and log everyone out.
4. Don’t reconnect UpdraftCentral yet, until TeamUpdraft ships its emergency release and explains the root cause.
5. Change your teamupdraft.com password, reset two-step login there, and reconnect UpdraftVault if you use it.
6. If a backdoor account existed, treat the whole site as compromised: the attacker had administrator-level access. Restoring from a backup made before 18 October 2026 is the safest way back; then change every password and key.

Indicators

Sources: TeamUpdraft’s incident notice, Patchstack’s analysis and Levamo’s report.

• Plugin description: “Small maintenance toolkit: keeps option storage tidy.” Random plugin names.
• Accounts: role Editor plus manage_options and install_plugins; display name “Site Tools”; email @example.org; usernames like data-ops43.
• Option: updraft_central_localkeys present.
• A probe message to the non-existent key probe.central.updraftplus.com, then the real install hours later.
• Attacker IPs: 43.250.53.42, 2a09:bac5:4e21:2e3c::49b:9.
• Recovery-mode emails naming a plugin you don’t know; every page showing a fatal error.

An older, unrelated UpdraftPlus flaw (CVE-2026-10795, fixed in UpdraftPlus 1.26.5 and Premium 2.26.5) was not used in these attacks.

Sources: TeamUpdraft’s security incident notice, Patchstack’s analysis and Levamo’s report.

Other plugins are being attacked right now too. See the live list of WordPress plugins under active attack.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

More guides

• Bricksforge vulnerability exploited: how to check your site and clean it
• Rank Math PRO 3.0.123 malware: who is affected and how to clean up
• Fake CAPTCHA malware hidden in the WordPress database: a real cleanup
• “This site may be hacked” in Google: how to get the warning removed
• WordPress site redirecting to spam? How to find and fix it
• Host suspended your WordPress site for malware? What to do next

All guides →