Supply chain

TeamUpdraft, the company behind the UpdraftPlus backup plugin and the UpdraftCentral remote management service, found an intruder on teamupdraft.com over the weekend of October 17 and 18. The company believes the customer database was accessed. It held names, email and billing addresses, order history, password hashes, two-factor settings, and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.

The attacker used those UpdraftCentral keys straight away. From 15:32 UTC on October 18, signed commands installed backdoor plugins on connected WordPress sites for about 18 hours, according to Patchstack. Any site that has ever been linked to UpdraftCentral Cloud is in scope, including sites whose owners never knowingly used it. Self-hosted UpdraftCentral is not affected, and the UpdraftPlus plugin files themselves were not tampered with.

How a management key becomes code on your site

The UpdraftCentral client ships inside every copy of UpdraftPlus, free and premium. It does nothing until the site holds a key. Creating a key generates a key pair: the site stores the dashboard's public key, and the matching private key stays with the UpdraftCentral Cloud service. When the dashboard wants a site to update a plugin or run a backup, it signs the command, and the site runs any command whose signature checks out. Nobody approves individual commands on the site side.

Whoever holds the dashboard's private keys can therefore manage every connected site. The attacker sent a signed plugin.upload_plugin command over the plugin's remote procedure call channel, which listens on ordinary POST requests to the site root. WordPress then installed and activated the supplied plugin through its normal installer. The command runs with the rights of the WordPress user who created the connection, which is why one of Nethemba's three targeted sites was spared: that account could not install plugins.

Two details widen the exposure. Keys do not expire, and Patchstack saw a key issued in November 2025 still working in October 2026. And connecting a site to a TeamUpdraft.com account from inside UpdraftPlus shows a checkbox, ticked by default, that also adds the site to UpdraftCentral. Some owners therefore hold a key they never meant to create. Nethemba and BleepingComputer estimate that about 10 percent of UpdraftPlus sites hold an UpdraftCentral or Migrator key, up to around 400,000 sites. That is potential exposure; nobody has published a count of sites that actually received a backdoor.

What the backdoor does

Patchstack logged at least 99 distinct plugin names, chosen to look like maintenance tools: "Site Health Cache" was the most common. Every sample carried the same description line, "Small maintenance toolkit: keeps option storage tidy." Patchstack calls that string the most reliable file-level marker.

The plugin hooks in early on every request and waits for a secret URL parameter carrying a 32-character token. With the right token it creates a user with the Editor role, then grants it the manage_options and install_plugins capabilities. It then sets a login cookie directly and redirects to wp-admin, which skips the login form, two-factor authentication and any login-limiting plugin. The account survives removal of the plugin. Nethemba also describes a newer variant that can log in as an existing administrator, and one that hides itself from the plugin list.

The first samples had a coding error that threw a fatal error and returned HTTP 500 on uncached pages. Nethemba's own sites, running WordPress 7.1.3 and UpdraftPlus 2.26.11, started returning those errors in the early hours of October 19, and two of the three had the plugin installed. Do not repair a broken copy to get the site back; fixing the error switches the backdoor on.

The fix has a gap

TeamUpdraft published UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) shortly after 22:00 BST on October 19, after an earlier 1.26.12 and 2.26.12 release failed to remove keys because of a bug. The update disconnects UpdraftCentral connections made before 13:07 BST (12:07 UTC) on October 18. Nethemba reports that keys created between 12:07 and 21:00 UTC that day survive the update and have to be deleted by hand.

Updating also does nothing about a plugin or account that is already there. On October 20 TeamUpdraft said the unauthorised access to its own systems was resolved, yet Nethemba saw the original attacker address send commands to two of its sites on October 21, after the fixed release. Both can be true, because a stolen key keeps working until each site deletes it.

What to do

Work on each site through its own wp-admin or shell, not through UpdraftCentral.

1. Check whether the site holds a key, even if you never used UpdraftCentral: wp option get updraft_central_localkeys. Any output means it does.
2. Delete every key first, so the attacker cannot push a replacement while you clean up. In wp-admin go to Settings, then UpdraftPlus Backups, then Advanced Tools, then UpdraftCentral, and delete everything under "Manage existing keys". With WP-CLI, wp option delete updraft_central_localkeys. Scheduled backups keep running without it.
3. Update UpdraftPlus to 1.26.13 or 2.26.13 or later.
4. Search for the plugin: grep -rl "Small maintenance toolkit: keeps option storage tidy" wp-content/plugins/. Check the Must-Use tab and wp-content/mu-plugins/ too, as TeamUpdraft advises. Deactivate anything you find and move its folder out of the web root so you keep a copy for analysis.
5. Look for the account. Users with the Editor role who also hold manage_options, an @example.org email address, or the display name "Site Tools" are suspect, as is an option whose name ends in _sync_token. Delete the account and the option.
6. Check access logs for the October 18 to 19 window and since. Patchstack treats a request carrying a short underscore-prefixed parameter with a 32-character value as proof the backdoor was used, not just installed. Patchstack lists 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9 as attacker addresses, but the attacker rotated infrastructure, so do not rely on blocking them.
7. Verify files against known-good copies with wp core verify-checksums and wp plugin verify-checksums --all. The plugin check only covers plugins from WordPress.org, so compare premium plugins and themes against fresh downloads, and review anything in wp-content modified since October 18.

If the account exists or the trigger shows up in your logs, treat the site as fully compromised. Restore from a backup taken before October 17, change every administrator password, end all sessions, and rotate the authentication keys and salts in wp-config.php (wp config shuffle-salts does it in one step), which also invalidates the login cookies the backdoor issued. Change your teamupdraft.com password, reset its two-factor setup, and if the site was ever reached through UpdraftCentral, re-authorise remote storage and rotate the storage access keys, as TeamUpdraft recommends. Reconnect to UpdraftCentral only after updating, and consider creating the key under an account that cannot install plugins.

The lesson for management planes

Every remote management service, from WordPress dashboards to remote monitoring and management (RMM) tools, works the same way: one vendor holds keys that every connected site obeys without asking, so an intrusion at the vendor reaches every customer site that still trusts those keys. Keep an inventory of which services hold that power over your estate, prefer keys that expire and can be scoped to fewer rights, and know how you would revoke them all in an hour.

If you need help checking WordPress sites for this campaign, our security operations team does this kind of triage, and safeguarding and hardening covers scoping management access so the next vendor breach reaches less. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Check Point Research, 26th October threat intelligence report, TeamUpdraft security incident notice, Patchstack, BleepingComputer, Brandefense.