Over the weekend of October 17 and 18, someone got into teamupdraft.com, the company behind UpdraftPlus, one of the most widely used backup plugins for WordPress. TeamUpdraft’s own notice says the intruder probably reached its customer database. That database held names, email and billing addresses, order histories, password hashes, two-factor settings, and something far more dangerous than any of those: the connection keys for its UpdraftCentral, UpdraftVault and UpdraftClone services.
We covered the news itself in a short summary. This post is about why this breach is different from the usual stolen-password story, and what it should change for anyone who runs a WordPress site.
A key is not a password
UpdraftCentral is a dashboard for managing many WordPress sites from one place: run backups, update plugins, install new ones. To make that work, each connected site agrees to trust commands signed by the dashboard. When a signed command arrives, the site carries it out with the rights of the WordPress user who made the connection, usually an administrator.
A stolen password still has to get past a login page, and maybe a two-factor prompt. A stolen connection key does not. To the site, a command signed with it looks exactly like one from the real owner. Researchers at Nethemba watched the attacker do precisely that, sending the dashboard’s own “upload a plugin” command to install backdoors. BleepingComputer, whose figures we used in our summary, puts the number of sites that could be exposed at around 400,000.
I manage several of my own WordPress sites from a single dashboard, so I understand the appeal. One login, every site, everything kept up to date. But this is the trade we all make with tools like that: whoever holds the master key holds every site at once. When the key lives on someone else’s server, their security becomes your security.
The part that should worry most people
Many affected site owners never set up UpdraftCentral on purpose. According to WP Umbrella, linking a TeamUpdraft account inside UpdraftPlus creates an UpdraftCentral key by default, through a box that comes already ticked. Plenty of people link their account just to unlock a premium feature or a storage add-on, and move on.
Those keys also never expired. Patchstack found keys issued in November 2025 still working this month. So a site owner who clicked through a setup screen a year ago and forgot about it was carrying a live remote control the whole time.
That is the real lesson here. Security problems are often blamed on careless users, but this one rests on two design choices made for convenience: connect by default, and never expire. Both made the product easier to use. Both made the breach much worse.
Not the first warning this year
In June, the same company patched CVE-2026-10795, a flaw that let attackers forge UpdraftCentral commands without any key at all, as Cyber Kendra recalls. Twice in five months, the remote-management channel has been the way in. A feature that can install software on your site deserves to be treated as your site’s front door, not as an extra.
Updating is not the same as cleaning
TeamUpdraft has moved quickly. It signed out every account, rotated its other credentials, and released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which disconnect every UpdraftCentral connection made before 22:00 BST on October 18. Self-hosted UpdraftCentral installations were not affected.
But an update only changes the lock. It does not remove anyone who already walked in. Researchers also say the cutoff leaves out some keys created during part of the breach window. If a backdoor plugin was installed on your site last weekend, it is still there after the update, and it may be hidden from the plugin list.
What to do if you use UpdraftPlus
- Log in to each site directly, not through a dashboard, and update UpdraftPlus to 1.26.13 or 2.26.13.
- Delete the key by hand anyway. Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and remove any connection key, even if you don’t remember creating one.
- Look for plugins and admin users you don’t recognize, especially anything added since October 17. Check the plugins folder on the server too, since some backdoors hide from the WordPress dashboard.
- If you find signs of a break-in, restore from a backup made before October 17, then change your admin passwords and re-authorize any remote storage the plugin uses.
- Watch your inbox. Names, email addresses and order histories were in that database. Expect convincing phishing emails that mention your real purchases. TeamUpdraft says payment card details were not stored there.
And whatever backup plugin you use, take five minutes to find out what it is connected to. Look for any setting that lets an outside service send commands to your site. If you don’t use it, turn it off. The most secure remote control is the one that was never handed out.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
