TeamUpdraft has confirmed that attackers used UpdraftCentral connection keys to interfere with WordPress websites, including creating unauthorized accounts and installing malicious plugins. The incident was identified over the weekend of October 17–18, 2026. The company's notice, updated on October 23, calls for individual checks of websites connected to its management platform.
The incident began with unauthorized access to the vendor's own website using a compromised key. Remote-management connections then allowed commands to be sent to customers' WordPress installations. The company closed the access route, replaced credentials and distributed updates that revoke older UpdraftCentral connections.
For websites already accessed, the response includes reviewing accounts, extensions and changes made during the incident. These activities are part of website maintenance, alongside installing corrected releases and checking that backups operate properly. The vendor asks administrators to work through each website's own dashboard to remove old connections and examine the installation.
Management keys opened access to connected websites
UpdraftCentral allows multiple websites to be managed from a central location. Keys associated with each connection authorize operations on registered sites. According to TeamUpdraft, the attacker exploited that trusted relationship to create users and install extensions on connected WordPress websites.
The company believes its customer database was accessed. It contains names, email and billing addresses, order history, passwords stored as hashes, two-factor authentication settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone. This list describes the contents of the database under investigation; it does not assign every possible consequence to every customer.
TeamUpdraft states that it does not store payment-card details, with Stripe and PayPal handling payments. Passwords in the database were not stored in plain text. As part of its response, the company signed every account out of its own website and requested password changes and two-factor authentication resets for accounts using that protection.
The vendor draws an important distinction between its central service and the backup plugin. According to its notice, UpdraftPlus files and download packages were not altered in this attack. The self-hosted version of UpdraftCentral, operated on a user's own infrastructure, is also outside the affected scope described by the company.
Updates close older connections; reviews address changes already made
UpdraftPlus versions 1.26.13 for the free edition and 2.26.13 for Premium were released on October 19. TeamUpdraft asks users to run those versions or later releases. Its detailed account of the measures says the updates automatically disconnect UpdraftCentral connections established before October 18 at 13:07 BST.
The instructions also include deleting the connection key directly from each website's UpdraftPlus settings. This lets an administrator handle each installation separately, including websites managed less frequently. Reconnection follows checks of users and plugins and changes to the passwords of website administrator accounts.
In its October 21 update, TeamUpdraft also asked UpdraftPlus Premium users who had never knowingly used UpdraftCentral to examine their websites for unusual activity. The request covers unexpected accounts and extensions. The connection inventory therefore needs to be checked directly, including for websites their owners do not associate with centralized management.
A further clarification, published on October 22, concerns the list of websites in an UpdraftCentral account. The vendor asks users to investigate sites appearing there without a connection they knowingly established from October 19 onward. This connects the central account inventory with the actual state of each WordPress installation.
The company specifically highlights unexpected users with the editor role, in addition to checks of administrators. Other items to examine include unfamiliar plugins and unusual IP addresses in logs. The review also extends to Must-Use extensions, which have a separate area in the WordPress dashboard.
Separate measures for backups, storage and clones
Where suspicious changes are found on a website, TeamUpdraft identifies restoration from a backup taken before October 17 as a possible response. Revoking a key stops that connection being used; restoring and examining the installation address earlier changes. These actions serve different purposes and appear separately in the vendor's instructions.
The company says backups sent to customers' own storage, such as Google Drive, Dropbox or Amazon S3, were not affected by the vendor incident. However, for websites accessed through UpdraftCentral, it asks administrators to reauthorize remote storage and replace the relevant storage access keys as a precaution for that compromised installation.
For UpdraftVault, every website was disconnected and credentials were replaced. New backups will not reach Vault until the connection is restored. The published procedure requires authentication with the new password, saving the configuration and running a manual backup to confirm that the service works again for each individual website.
UpdraftClone follows a separate process: client keys have been replaced and previous keys no longer work. Customers who shared those keys with other people need to distribute the replacements. Cloning operations using withdrawn credentials will fail until their configuration is updated, according to the vendor's explanation.
For users of the free UpdraftPlus edition who do not have a TeamUpdraft account, the notice requires no incident-specific action. That distinction separates the backup plugin's wider audience from users of the central services and accounts involved in the investigation. The number of UpdraftPlus installations is not a count of compromised websites.
TeamUpdraft announced that an external security firm had joined its investigation and that it had notified the UK's Information Commissioner's Office, along with other relevant authorities. Its published measures include replacing keys used with payment providers and connected services, additional monitoring and separate instructions for each product in its portfolio.
