What happened at UpdraftPlus in October 2026
The vendor, TeamUpdraft, identified unauthorised access to its own website on 17 and 18 October 2026. The data involved includes UpdraftCentral connection keys, the remote management service. With such a key, an attacker signs commands that a site accepts as coming from its dashboard, including the installation of a plugin. Patchstack observed the first backdoor installation on 18 October at 15:32 UTC and counts at least 99 malicious plugins with distinct names, disguised as maintenance tools. The central point lies elsewhere: this is not a flaw in the backup plugin. The vendor states that the plugin and its downloads are not affected, nor are backups kept in your own remote storage. The danger comes from a stolen remote management key, not from WordPress backups in general.
Versions and situations: where each site stands
Scroll the table
| Situation | Status | Action |
|---|---|---|
| UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium), or newer | Existing UpdraftCentral connections are revoked, according to the vendor | Still check keys, plugins and accounts |
| UpdraftPlus 1.26.12 | According to Nethemba, a bug prevented the keys from being removed | Move to 1.26.13 or newer, then delete the keys |
| Older version | A key may remain valid | Update, then delete the keys |
| Plugin up to date, fake plugin already planted | The update does not remove the fake plugin | Audit plugins and accounts, see below |
| Site never connected to UpdraftCentral | No key expected | Read the keys option to be sure |
| Self-hosted UpdraftCentral | Not affected, according to the vendor | No action specific to this incident |
| Backups in your own remote storage | Not affected, according to the vendor | Re-authorise the storage and change its keys |
Why "up to date" does not mean "clean"
The sentence "my plugin is up to date, I am covered" is wrong for two reasons. First, version 1.26.12 was meant to remove the keys but, according to Nethemba as quoted by BleepingComputer, a bug prevented it: only 1.26.13 and 2.26.13 fixed that point. Second, an update changes the code of the backup plugin; it removes neither a fake plugin that is already installed nor an administrator account that already exists. The vendor has also reported, in an update to its notice, sites where a plugin dropped by the attacker survived the initial incident and later created a new administrator, even after disconnection. A site is therefore declared clean only after checking keys, plugins and accounts, never on the strength of a version number.
The signs to look for on each site
- An unknown plugin — the name Site Health Cache comes up often according to Patchstack, but the list is not exhaustive: the vendor also names Asset Forge 2, Core Smith, Image Forge and WP Forge.
- A telltale description — the string "Small maintenance toolkit: keeps option storage tidy." is the most reliable file-level indicator according to Patchstack; not finding it proves nothing.
- A hidden account — usernames such as data-ops43 or media-staff96, an example.org address, the display name Site Tools; some plugins hide these accounts from the Users screen.
- An option ending in
_sync_token— an entry whose name ends this way in the options table accompanies the backdoor. - An install with no author — a plugin that appeared without any administrator action, or a WordPress error email naming a plugin nobody knows.
- A key still present — the
updraft_central_localkeysoption is not empty: the site stays exposed as long as that key exists. - A log line — in the UpdraftCentral log,
probe.central.updraftplus.comfollowed byCommand received: plugin.upload_plugin.
Audit each site, in order
Work from the site itself
Open the site's own WordPress dashboard, or an SSH session, but not UpdraftCentral: the vendor asks you to log in to each site directly.
Read the existing keys
wp option get updraft_central_localkeys
Non-empty output means the site is exposed, according to Patchstack, even if you never used UpdraftCentral. An "option does not exist" error means no key is present.Update, then delete the keys
wp plugin update updraftpluswp option delete updraft_central_localkeys
The graphical path is Settings > UpdraftPlus Backups > Advanced Tools > UpdraftCentral, then "Manage existing keys"; the exact label varies by version, so the command is the reference gesture. Removing the site from the UpdraftCentral dashboard is not enough. Backups keep working.List the plugins and compare
wp plugin list --fields=name,status,versionls wp-content/mu-plugins/
Compare with the expected list for the portfolio: a plugin nobody approved is suspect, including in the Must-Use folder, which the Plugins screen does not always display.Search for the fake plugin's signature
grep -r "Small maintenance toolkit: keeps option storage tidy." wp-content/plugins/ wp-content/mu-plugins/
A hit is an alert. An empty search does not prove the site is clean.List privileged accounts
wp user list --role=administrator --skip-pluginswp user list --role=editor --skip-plugins
The--skip-pluginsoption matters: it avoids loading the plugins that hide accounts on screen. Compare with the expected list of people who actually administer the site.Look for the backdoor option
wp option list --search="*_sync_token"
Any entry found calls for the "compromised site" handling in the next section.Record the result
One line per site: UpdraftPlus version, keys present or not, plugin gap, account gap, audit date, decision. This register serves as proof for the client and as a baseline for the next incident.
The same checks by environment
Scroll the table
| Environment | Typical command | Note |
|---|---|---|
| Debian or Ubuntu | `sudo -u www-data wp --path=/var/www/html plugin list` | Adapt the path and the user to your installation |
| RHEL, AlmaLinux or Rocky | `sudo -u apache wp --path=/var/www/html plugin list` | User `nginx` if the web server is nginx |
| Docker Compose | `docker compose exec -u www-data wordpress wp plugin list` | The service name depends on your file; WP-CLI is often missing from the WordPress image, check |
| Shared hosting with SSH | `wp plugin list` from the site folder | Without SSH, use the file manager or SFTP |
| Without WP-CLI | Inspect `wp-content/plugins/` and `wp-content/mu-plugins/` over SFTP | Compare each folder with the expected list |
| All environments | `wp config shuffle-salts` | Changes the WordPress security keys and closes open sessions |
At the slightest sign, treat the site as compromised
If a backdoor account exists or the trigger appears in the logs, Patchstack recommends treating the site as fully compromised. The order matters. Delete the UpdraftCentral key first, otherwise the attacker keeps their way in. Then deactivate the fake plugin and remove its folder directly on the server: the vendor warns that some plugins are designed to erase their traces when deleted from the dashboard. Do not fix a code error in that plugin to "repair" it: Patchstack warns that this activates the backdoor. Remove the account and the _sync_token option, then prefer restoring over manual cleanup, because nothing proves that a hand cleanup found everything.
Restore cleanly
Choose the restore point
Take a backup from before 17 October 2026 and check that it really predates the compromise: file dates, the last known plugin installation, server logs.
Restore outside production
Mount the backup on a test site or a disposable server, never directly in production. Re-run the audit section checks there: keys, plugins, accounts, signature.
Compare with a clean installation
wp core verify-checksumswp plugin verify-checksums --all
These commands compare core and plugin files with the checksums of the official directory; a modified file is reported.Update before going back online
Move UpdraftPlus to 1.26.13 or 2.26.13 at the very least, update everything else, then delete the keys again: a backup from before the incident may contain some.
Return to production and monitor
Switch over the restored site, then re-read plugins and accounts over the following days. A plugin or account that reappears signals a door still open elsewhere.
Decide on reconnection
TeamUpdraft allows reconnecting to UpdraftCentral once the site is checked and secured. At the date of its article, Patchstack advised waiting for the cause to be explained. If you do not need remote management, leave it disconnected.
Restoring does not replace revoking
Restoring a clean backup does not exempt you from deleting the keys or changing credentials: the vendor says so itself. Always proceed in this order: keys deleted, passwords changed, sessions closed, then back online.
Remote storage, sessions and passwords
Backups kept in your remote storage (Google Drive, Dropbox, Amazon S3) are not affected, according to the vendor, but sites reachable through UpdraftCentral must re-authorise that storage and change its access keys. Rotate the S3 keys, renew the authorisation for Drive or Dropbox accounts, then change the WordPress security keys with wp config shuffle-salts and the passwords of all legitimate administrator and editor accounts. On the vendor side, change your password by typing the address by hand in the browser, reset two-factor authentication, and if you use UpdraftVault, reconnect the storage and run a manual backup: the sites had been disconnected. The data exposed at the vendor includes names, email addresses, billing addresses and order history; passwords are stored there only in hashed form.
For an agency: one inventory, not ten spreadsheets
Across dozens of sites, the time does not go into the command, it goes into the question "who has what". Keep a living register per site: UpdraftPlus version, presence of keys, expected plugin list, expected administrator list, date of the last audit, date of the last backup. Without a reference list, a plugin is never "unknown", only "not yet seen". Look at your restore points before you need them: at ServOrbit.com, backups are weekly on entry-level plans and daily on the Pro plan and on every Agency plan, and you should check that a copy from before 17 October 2026 still exists. Our guide on testing the restore of a client VPS backup describes the procedure to rehearse cold, and the update routine for a portfolio remains the one from the two recent WordPress alerts.
Official documentation
TeamUpdraft notice on the October 2026 incident: https://teamupdraft.com/blog/security-incident-october-2026/
Patchstack analysis: https://patchstack.com/articles/updraftcentral-key-compromise-wordpress-backdoors/
BleepingComputer article: https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/
WP-CLI, user list: https://developer.wordpress.org/cli/commands/user/list/
WP-CLI, plugin checksum verification: https://developer.wordpress.org/cli/commands/plugin/verify-checksums/
WP-CLI, security key rotation: https://developer.wordpress.org/cli/commands/config/shuffle-salts/
