UpdraftPlus: delete the UpdraftCentral keys from your WordPress site, even if you have never used it
Partner · Web development, SEO and GEO
If your WordPress site uses UpdraftPlus, open the plugin's UpdraftCentral tab today and delete every key you find there. Keys stolen from the plugin's publisher were used to install backdoors on websites, still on the morning of October 19, 2026. A key can exist even if you have never used UpdraftCentral. Updating to version 1.26.13 (the latest release as of October 20, 2026) is necessary, but it is not enough: it leaves some keys in place and removes no backdoor that is already installed.
What happened at TeamUpdraft
UpdraftPlus is the most widely used backup plugin for WordPress: more than four million sites run it. Its publisher, TeamUpdraft, also offers UpdraftCentral, a dashboard for managing several sites remotely: backups, updates, plugins.
In its October 19 notice, TeamUpdraft says it detected unauthorized access to its teamupdraft.com website over the weekend of October 17 and 18. The company believes its customer database was accessed. That database holds names, email and billing addresses, order history, passwords (hashed), two-factor authentication settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card numbers are not stored there: Stripe and PayPal process payments. According to TeamUpdraft, the plugin itself and its downloads were not affected.
How the stolen keys were used
An UpdraftCentral key lets the dashboard send commands to your site. The site runs any command signed with the right key, with the permissions of the person who made the connection, without asking for confirmation. That is what the attackers used: Patchstack recorded correctly signed commands that installed and then activated a malicious plugin, for about 18 hours, from October 18 to the morning of October 19.
Slovak security firm Nethemba caught the attack on three of its own sites overnight on October 19, then reported it to TeamUpdraft. Patchstack puts it plainly: "This is not a vulnerability in UpdraftPlus." No bug in the plugin's code was needed: the commands were genuine, the keys no longer were.
Once installed, the malicious plugin waits for a secret code in a page address. With that code, it creates an Editor account, gives it the rights to manage settings and install plugins, then logs the visitor in directly with a cookie. The login form is bypassed, so two-factor authentication does not apply. The account stays in place even if the plugin is deleted.
| Date | What happened |
|---|---|
| June 2026 | TeamUpdraft fixes CVE-2026-10795 in version 1.26.5. It allowed attackers to forge UpdraftCentral commands without any key. |
| October 17 and 18 | Unauthorized access to teamupdraft.com and likely access to the customer database. |
| October 18 and 19 | Commands signed with stolen keys install backdoors. Patchstack records 99 different plugin names. |
| October 19 | Nethemba publishes its analysis. TeamUpdraft publishes its notice and version 1.26.12, then version 1.26.13 that same evening. |
| October 20 | TeamUpdraft updates its notice. Nethemba confirms that version 1.26.13 leaves some exposed keys in place. |
Why your site may have a key without your knowing
The title of this note is not an exaggeration. According to Patchstack, when you link a site to a teamupdraft.com account (which UpdraftPlus Premium asks you to do to activate its license), a checkbox that adds the site to UpdraftCentral is checked by default. A simple license activation could therefore create a key without anyone meaning to manage the site remotely.
These keys do not expire. Patchstack reports that keys created in November 2025 still worked in October 2026. Removing the site from your UpdraftCentral dashboard does not delete the key that stays on the site either.
What if your site uses the free version?
TeamUpdraft says that a free-version user who never created a teamupdraft.com account has nothing to do, other than keep the plugin up to date. That does not make the free version safe by default: according to Patchstack, the UpdraftCentral module ships in every copy of UpdraftPlus, free and Premium alike.
A free site can therefore have a key if someone once linked it to the online UpdraftCentral dashboard, which requires a teamupdraft.com account. That person may be a former provider, a freelancer or a colleague who wanted to try it. Since keys never expire, a connection made years ago still counts. Whoever manages the site today may not know about it.
A free version that has not been updated in a long time has another problem too. Up to version 1.26.4, CVE-2026-10795, fixed in June 2026, let attackers send forged commands to a site without any key. Patchstack reports that attack attempts still target it.
On a free site, the check takes a minute: update UpdraftPlus, then open the plugin's UpdraftCentral tab. If the list of keys is empty, you are done. If there is a key, delete it and run the other checks in this note.
Updating is not enough
TeamUpdraft released version 1.26.12 (2.26.12 for Premium) on October 19 to disable keys created before the incident. Nethemba found that, because of a bug, it deleted no key at all. Version 1.26.13, released that same evening, fixes that bug. It is the latest version of UpdraftPlus on WordPress.org as of October 20, 2026.
A gap remains. According to TeamUpdraft, the update cuts connections made before 10 p.m. (London time) on October 18, which is 5 p.m. in Montreal. According to Nethemba, version 1.26.13 only deletes keys created before 8:07 a.m. (Montreal time) that day. A key created between those two times therefore stays on the site after the update, even though TeamUpdraft considers it exposed. Above all, no update removes a backdoor or an account that is already installed.
The first versions of the backdoor contained a bug that crashed some pages (500 error). If an unknown plugin is crashing your site, do not repair it: according to Patchstack, fixing the error switches the backdoor on. Remove it.
What to do today, on every site
- Log in to the site's own dashboard, never through UpdraftCentral. Update UpdraftPlus to version 1.26.13 or later (2.26.13 or later for Premium).
- Delete the keys. Under Settings, open UpdraftPlus Backups, then Advanced Tools and UpdraftCentral. Delete every key in the list of existing keys, even after the update.
- Review the list of plugins, including the Must-Use tab. A plugin nobody recognizes, or whose description reads "Small maintenance toolkit: keeps option storage tidy," must be removed. The name "Site Health Cache" comes up often, but the other names vary.
- Review the list of users. Delete any account nobody recognizes, especially an Editor whose username follows the pattern of two words and two digits (data-ops43, media-staff96) or whose email ends in @example.org.
- Change the passwords of administrators, then the password of the teamupdraft.com account. Go to teamupdraft.com directly, never through a link received by email.
- Wait before reconnecting UpdraftCentral. TeamUpdraft says a site reconnected now will not be disconnected again. Patchstack advises waiting until the publisher explains the cause of the intrusion.
If you find a malicious plugin or a suspicious account, treat the site as compromised. Restore a backup taken before October 17, change every password, end all sessions and change the access keys for your backup storage (Google Drive, Dropbox, Amazon S3).
Our website maintenance service handles this kind of alert proactively: we check the sites, apply fixes as soon as they are reliable and monitor accounts and plugins at all times. You no longer have to follow these announcements yourself.
An agency or a webmaster who manages several sites saves time with WP-CLI, the WordPress command-line tool. The command wp option get updraft_central_localkeys shows whether a site has keys: any output means the site is exposed. The command wp option delete updraft_central_localkeys deletes them. Searching for the phrase "Small maintenance toolkit" in the wp-content/plugins folder finds the backdoor.
Nethemba also publishes a checking script that changes nothing on the site: it looks for keys, the UpdraftCentral log, the backdoor's files and settings, and suspicious accounts. Order matters: delete the key first, then remove the malicious plugin and the account. Nethemba insists on deleting the key even after removing the backdoor. For each client, also note who holds the teamupdraft.com account linked to their Premium license: that person needs to change their password.
Who should apply these patches, and how fast, is covered in who applies your website's security patches. Our earlier note on the September 2026 WordPress and Elementor patches shows the same speed of attack.
- TeamUpdraft, TeamUpdraft security incident: What customers need to know, Joe Whittaker, October 19, 2026, updated October 20, 2026. Source for the intrusion, the data involved, the disconnection cutoff and the recommended steps.
- Patchstack, Stolen UpdraftCentral Keys Are Backdooring WordPress Sites, Dave Jong, October 19, 2026. Source for how the attack works, the checkbox checked by default, the keys that never expire and the indicators of compromise.
- Nethemba, UpdraftCentral backdoor analysis, October 19, 2026, updated October 20, 2026. Source for the discovery, the bug in version 1.26.12, the gap in version 1.26.13 and the checking script.
- WordPress.org, UpdraftPlus: WP Backup & Migration Plugin, accessed October 20, 2026. Source for the latest version number and the changelog.
- Dr. Web, UpdraftPlus: Erst Version 1.26.13 sperrt die gestohlenen Schlüssel, October 2026. Source for the release times of both updates.
Geneviève puts the strategy for your engagement into action. She leads all our web development projects: Shopify, WordPress and the new ways of building a site with AI. She manages our team of developers and translates your business needs into technical language. She runs your organic search (SEO), your visibility in AI answers (GEO) and your site's conversion rate optimization (CRO). Her work is at the heart of three goals: Attract customers with SEO and AI, Improve your site's conversion, and Strengthen your visibility in AI answers. With Gabriel, she also builds the landing pages for your advertising campaigns. She writes mainly about SEO, AI visibility and web design.
About Falia →
SEO
Paid advertising
Conversion
AI visibility
Web design