UpdraftPlus backdoor via UpdraftCentral (no CVE): am I affected?

What happened

On 17 and 18 October 2026 TeamUpdraft, the vendor of UpdraftPlus, detected unauthorised access to teamupdraft.com. The vendor believes the customer database was accessed, including the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The intrusion is confirmed; where exactly the abused keys came from is not fully settled, according to The Hacker News.

After that, attackers holding valid UpdraftCentral keys sent signed commands (plugin.upload_plugin) to connected WordPress sites. WordPress installed and activated a backdoor plugin through them. Because the commands are correctly signed, this is not a flaw in the UpdraftPlus code and there is no CVE. Patchstack classes it as a key compromise.

The backdoor reacts to a secret URL parameter, creates an account with the Editor role and adds the capabilities manage_options and install_plugins. Login works through a cookie and bypasses the login form, so 2FA and login protection plugins do not apply, according to Patchstack. The account stays after you remove the plugin.

Affected and fixed versions

• 1.26.13 and 2.26.13 disconnect all UpdraftCentral connections created before 18 October 2026, 12:07 UTC (13:07 BST). According to Nethemba, 1.26.12 does not delete any keys yet.
• Keys created later on 18 October survive the update, according to Nethemba. Delete them by hand.
• According to Patchstack, sites that never knowingly used UpdraftCentral can still hold a key (a checkbox was ticked by default when linking a TeamUpdraft account). TeamUpdraft asks premium users to check their sites regardless.
• How many sites were attacked is not known.

Is it being exploited?

Yes. Patchstack saw the first backdoor install on 18 October at 15:32 UTC and the latest observed one on 19 October at 09:23 UTC, with 99 distinct plugin names. Nethemba found the attack on three of its own sites. Future waves may use new names. There is no CVE, so the incident is not in the CISA KEV catalog either.

Am I affected? How to check

The commands assume WP-CLI in the web root and the table prefix wp_.

Is there an UpdraftCentral key?

wp option list --search="updraft_central_localkeys" --fields=option_name

Unknown users, especially with the Editor role:

wp user list --role=editor --fields=ID,user_login,user_email,user_registered
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Suspicious are Editor accounts with admin capabilities, email addresses on @example.org or @example.com and the display name “Site Tools”. Confirmed examples are data-ops43 and media-staff96. Recognise the accounts by capabilities, not by name.

New plugins since 17 October, including the must-use folder:

find wp-content/plugins wp-content/mu-plugins -maxdepth 1 -newermt 2026-10-17

The description that, according to Patchstack, appears in the backdoor plugins:

grep -rl "Small maintenance toolkit: keeps option storage tidy" wp-content/

A database option whose name ends in _sync_token:

wp db query "SELECT option_name FROM wp_options WHERE option_name LIKE '%\_sync\_token'"

In access logs, hits on the URL parameter _9f5696= (according to The Hacker News) or on the IP addresses 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9 indicate activity. Blocking IPs alone is not enough, the infrastructure changed within a day according to Patchstack.

Pitfalls

The update does not clean up. It invalidates old keys but removes no installed backdoor plugins, accounts or options.

Removing the site in the dashboard is not enough. Backups keep running, only remote management stops. The key itself must be deleted.

Do not “fix” the HTTP 500. According to Patchstack, a coding error in the backdoors analysed so far makes affected sites answer with HTTP 500. Fixing the error activates the backdoor.

The plugin list can mislead. According to Nethemba, the “Site Health Cache” variant hides itself from the plugin list via filters and is still active. Check files, not just the admin menu.

Do not delete via wp-admin. According to Patchstack the uninstall routine wipes traces. Deactivate the plugin and move it out of the web root.

The account survives plugin removal. Delete accounts and options separately.

Scanners do not see it. There is no CVE and no advisory. Tools built on advisories and CVE records report nothing for this, and so does Stackwatch. The free check therefore does not cover this incident.

What to do now

1. Log in to the WordPress dashboard directly, not through UpdraftCentral.
2. Update UpdraftPlus to 1.26.13 (Free) or 2.26.13 (Premium) or newer.
3. Under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral delete all connection keys, or run wp option delete updraft_central_localkeys.
4. Check as above: users, plugins (including must-use), options, logs.
5. Remove anything unknown, in this order: key, plugin (move it), accounts and options.
6. Change the passwords of all administrators and end sessions.
7. If compromise is confirmed, restore a backup from before 17 October and compare the files with a clean install.
8. Re-authorise remote storage (Google Drive, Dropbox, S3) if the site was reachable through UpdraftCentral.
9. For the teamupdraft.com account: change the password, reset 2FA, replace the password elsewhere too. Reconnect UpdraftVault, create new keys for UpdraftClone.
10. Only then reconnect the site to UpdraftCentral.

If you cannot patch right away

Delete the UpdraftCentral keys first (see above). That stops remote access, backups keep running. Without a key an attacker can no longer sign commands. Then check the site as described.

The earlier flaw CVE-2026-10795

Independent of this incident, CVE-2026-10795 (CVSS 8.1) was published on 11 June 2026: an authentication bypass in the UpdraftCentral path, affecting versions up to and including 1.26.4. According to Patchstack it is fixed in 1.26.5 and 2.26.5. With 1.26.13 and 2.26.13 you are covered there too.

Sources

• TeamUpdraft: Security incident October 2026
• Patchstack: UpdraftCentral key compromise and WordPress backdoors
• Nethemba: UpdraftCentral backdoor analysis
• The Hacker News: Attackers abuse UpdraftCentral keys
• Search Engine Journal: UpdraftPlus plugin security breach
• CVE-2026-10795 (CIRCL)