--- title: "UpdraftCentral Hack: Stolen Keys Backdoored WordPress Sites" slug: "updraftcentral-hack-stolen-keys-backdoor" description: "The UpdraftCentral hack let attackers use stolen keys to install backdoors on WordPress sites. The update leaves a gap. Here's how to check and clean yours today." date: 2026-10-20 author: "WP Vanguard Team" category: "News" palette: "crit" tags: ["updraftcentral-hack", "updraftplus", "teamupdraft-breach", "backdoor", "actively-exploited"] offer: "owner" featured_image: "/images/blog/updraftcentral-hack-stolen-keys-backdoor.jpg" --- The UpdraftCentral hack is the worst kind of WordPress incident: the site owners did nothing wrong. Over the weekend of October 17 and 18, 2026, an attacker got into teamupdraft.com and took the customer database, including the UpdraftCentral connection keys. From October 18 at 15:32 UTC, those keys were used to install backdoor plugins on connected sites. Patchstack counted 99 different backdoor names in the first 18 hours. Every command arrived correctly signed, so UpdraftPlus treated each one as genuine. The sites were patched and up to date, and it didn't matter. If any of your sites run UpdraftPlus, check them today, and don't assume the vendor's emergency update has done it for you. It hasn't, and we'll show you the line of code that proves it. ```stat {"value": "~400,000", "label": "sites could hold an UpdraftCentral key, by TeamUpdraft's own estimate", "note": "Under 10% of 4M+ UpdraftPlus installs, per the vendor's June figure cited by Nethemba."} ``` ## What happened in the UpdraftCentral hack UpdraftCentral is TeamUpdraft's remote management service. Its client ships inside every copy of UpdraftPlus, free and Premium, and stays dormant until the site gets a key. Once it has one, the site runs any command signed by the matching dashboard key, with nobody approving individual commands. That's the whole point of the service: an agency can update, back up and manage fifty sites from one screen. The dashboard's private keys never sit on your server. For the cloud version they live with TeamUpdraft, and that was the weak point. TeamUpdraft's incident notice says it believes its customer database was accessed. That database held names, emails, billing addresses, hashed passwords, two-factor settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company has reported it to the UK Information Commissioner's Office. Nethemba, a security firm, found the attack on its own sites first. Its analysis is blunt: "The fault was not on our side." Its sites ran current WordPress and a patched UpdraftPlus. The attacker didn't break into their servers. They walked in through a channel the sites were built to trust. ```timeline {"title": "The UpdraftCentral hack", "highlight": 4, "data": [ {"label": "Oct 17-18", "sub": "Weekend", "text": "teamupdraft.com database accessed"}, {"label": "Oct 18", "sub": "15:32 UTC", "text": "First backdoor installs seen"}, {"label": "Oct 19", "sub": "TeamUpdraft", "text": "Breach confirmed, 1.26.12 ships"}, {"label": "Oct 19", "sub": "Evening", "text": "1.26.13 fixes a revocation bug"}, {"label": "Now", "sub": "Your sites", "text": "Delete keys by hand"} ]} ``` ## Why your security plugin didn't stop it This is the part that should worry every site owner. The attacker sends a signed `plugin.upload_plugin` command, and WordPress installs and activates the plugin through its normal installer. No password was guessed and no bug was exploited. One administrator told Nethemba their site ran Wordfence, Patchstack and Cloudflare, and none of them stopped the command, because it looked exactly like a real one. Patchstack has since added rules that block UpdraftCentral remote commands for its users. The backdoor itself is built to slip past a quick look. In the samples Patchstack analysed, it waits for a secret 32-character token in a URL, then creates an account and logs the attacker in by setting the login cookie directly. That skips the login form, so two-factor authentication and login limits never run. The account shows up as an **Editor**, so a scan of your administrator list misses it. It also holds `manage_options` and `install_plugins`, which is all an attacker needs to run code and promote itself. It gets worse. Nethemba has now seen four variants. One, named "Site Health Cache", hides itself from the Plugins screen. Another logs the attacker in as one of your existing administrators and writes nothing to the database, so only your access log shows it happened. On one site the attacker deleted a broken backdoor and uploaded a working one two seconds later. > [!KEY] > A stolen key keeps working until each site deletes it. Nethemba saw new attacks after TeamUpdraft had closed the breach, so a patched vendor doesn't mean a safe site. ## The emergency update has a gap TeamUpdraft released UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium) on October 19 to disconnect every cloud connection made before 22:00 BST, which is 21:00 UTC, on October 18. Nethemba found that 1.26.12 had a bug and removed no keys at all. The fix came the same evening in 1.26.13 and 2.26.13. **Skip 1.26.12. Go straight to 1.26.13 or later.** Even 1.26.13 doesn't match the vendor's own cutoff. We pulled the code from the WordPress plugin repository. The revocation runs on every page load with a hardcoded timestamp: ```php $this->udcentral_keys_revocation(1792325220); ``` That number is October 18, 2026, 12:07 UTC. Any cloud key created between 12:07 and 21:00 UTC that day survives the update, even though TeamUpdraft treats it as exposed. The code also only touches cloud keys. Self-hosted UpdraftCentral dashboards weren't part of the breach, and the update leaves them alone. One more trap catches people who think they never used UpdraftCentral. When you connect a teamupdraft.com account, for example to activate a Premium licence, the screen shows a checkbox reading "Add this website to UpdraftCentral". It's ticked by default. Patchstack found it hardcoded as `checked="checked"` in the plugin, so one licence login can enrol a site without the owner noticing. ## How to check every site that runs UpdraftPlus Do this on every site with UpdraftPlus installed, including the ones you don't look after day to day. Log in to each site's own dashboard, not through UpdraftCentral. **1. Update and delete the key.** Update to 1.26.13 or 2.26.13. Then go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete every connection key. If you have WP-CLI, this lists what's there and when each key was created: ```bash wp eval 'foreach ((array) get_option("updraft_central_localkeys") as $k) { echo gmdate("Y-m-d H:i", $k["created"] ?? 0), " UTC ", $k["extra_info"]["mothership"] ?? "?", "\n"; }' ``` A line with `__updraftpluscom` and a date before 2026-10-18 21:00 is a cloud key that was exposed. Delete it, even if you've already updated. **2. Look for the backdoor on disk.** The Plugins screen can lie, so search the files. Every sample Patchstack collected carried the same description line: ```bash grep -rl "Small maintenance toolkit: keeps option storage tidy" wp-content/plugins/ wp-content/mu-plugins/ ls -la wp-content/plugins/ wp-content/mu-plugins/ ``` Treat any plugin folder you don't recognise as hostile, and pay special attention to anything named "Site Health Cache". Nethemba saw variants with other names and descriptions, so an empty grep isn't a clean bill of health. **3. Find accounts with powers their role shouldn't have.** Search by capability, not by role or name: ```bash wp db query "SELECT u.user_login, u.user_email FROM wp_users u JOIN wp_usermeta m ON m.user_id = u.ID WHERE m.meta_key = 'wp_capabilities' AND m.meta_value LIKE '%editor%' AND m.meta_value LIKE '%manage_options%'" ``` Adjust the `wp_` prefix if your site uses a different one. The confirmed usernames so far are `data-ops43` and `media-staff96`, with an `@example.org` email and the display name "Site Tools". Assume there are others. **4. Read the access log.** A hit on this pattern means the backdoor was used, not just installed: ```bash grep -E '[?&]_[A-Za-z0-9]{4,10}=[A-Za-z0-9_]{32}([&"[:space:]]|$)' access.log grep 'class-udrpc\.php"' access.log ``` The second search catches the attacker's user agent. Real UpdraftCentral traffic ends with the URL `https://teamupdraft.com`, and the attacker's requests stop at `class-udrpc.php`. Patchstack lists the source addresses as `43.250.53.42` and `2a09:bac5:4e21:2e3c::49b:9`, but the attacker rotated within a day, so use them to search, not to block. ## Clean up if you find something Don't repair the backdoor. The early samples crashed with a fatal error and turned sites into HTTP 500 pages, and Patchstack warns that fixing that error switches the backdoor on. Remove it. 1. Delete the UpdraftCentral key first, so the attacker can't put the backdoor straight back. 2. Delete the backdoor plugin folders and any matching file in `mu-plugins`. 3. Delete the rogue accounts, then change the password of every real administrator. 4. Look for an option ending in `_sync_token` in `wp_options` and remove it. 5. If you're unsure what else changed, restore from a backup taken before October 17. Our [WordPress malware removal guide](/blog/wordpress-malware-removal-guide) covers the full process, and our guide to [PHP backdoors in WordPress](/blog/php-backdoors-in-wordpress) shows where a second one tends to hide. 6. Change your teamupdraft.com password, reset its two-factor setup, and change that password anywhere else you reused it. 7. If the site was reached through UpdraftCentral, re-authorise your remote backup storage and rotate its access keys, as TeamUpdraft advises. Then reconnect UpdraftCentral only if you need it. Backups keep working without it. ## If you run sites for clients Agencies carry the biggest share of this one. UpdraftCentral exists so you can manage many client sites from one account, which means one stolen key set reached every site connected to it. Your clients didn't choose TeamUpdraft's servers. You did, and they'll ask you what happened. Work through every client site, not a sample, and keep a written record of what you checked and when. This is the second serious problem in the same channel in five months. In June, [CVE-2026-10795](/blog/updraftplus-auth-bypass-rce-cve-2026-10795) let attackers forge UpdraftCentral commands with no key at all, and any site still below 1.26.5 or 2.26.5 faces both problems at once. It also follows the [Rank Math Pro supply chain compromise](/blog/rank-math-pro-malware-supply-chain-compromise) by a matter of days. Remote access you didn't build is access you have to watch. ## Check your sites with WP Vanguard Our [$1 deep scan](https://wpvanguard.com/pricing) now checks for this incident directly. It reads the UpdraftCentral keys stored on the site and flags any cloud key created before the breach cutoff, including keys in the 12:07 to 21:00 gap. It also flags any account that holds administrator powers without the administrator role, and it searches the plugin files for the backdoor's signature. If it finds something, our [$49 cleanup](https://wpvanguard.com/pricing) removes it, and the first cleanup is free for new users. A free surface scan won't see this one, because the backdoor lives inside the site. For the other updates that matter this week, see [the plugins to patch this week](/blog/wordpress-plugins-to-patch-this-week). ## References - [TeamUpdraft: Security incident, October 2026](https://teamupdraft.com/blog/security-incident-october-2026/) - [Patchstack: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites](https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/) - [Nethemba: UpdraftCentral backdoor analysis](https://nethemba.com/updraftcentral-backdoor-analysis/) - [UpdraftPlus 1.26.13 source, class-updraftplus.php](https://plugins.svn.wordpress.org/updraftplus/tags/1.26.13/class-updraftplus.php)