TeamUpdraft disclosed a security incident affecting its main website, exposing potential user data and remote management keys for UpdraftCentral.
Attackers leveraged compromised connection keys to install malicious plugins on WordPress sites.
Admins must update to UpdraftPlus 1.26.12 or 2.26.12 immediately.
TeamUpdraft announced on Monday, October 19, 2026, that it detected unauthorized access to its official website, teamupdraft.com, during the weekend of October 17–18.
The incident takes on particular significance as the company develops UpdraftPlus, one of the most popular WordPress backup tools, with more than 4 million active installations worldwide.
According to the official announcement, there are indications that the attackers gained access to the customer database. At the same time, independent security researchers have recorded real attacks on websites using keys from the UpdraftCentral service.
What data may have been leaked
READ ALSO
Security flaw in Broadcom chip allows strangers to control nearby routers
The compromised database includes information such as:
Customer names and email addresses.
Billing addresses and order history.
Passwords stored in hashed format rather than plain text.
Two-factor authentication (2FA) settings.
Connection keys for UpdraftCentral, UpdraftVault and UpdraftClone services.
The company clarifies that it does not store payment card information, as transactions are processed through Stripe and PayPal.
It also points out that the UpdraftPlus plugin itself and its official download files were not compromised.
How hackers managed to attack WordPress websites
The most serious element of the case concerns UpdraftCentral, the service that allows administrators to remotely control multiple WordPress websites.
The function is based on special connection keys, which allow authorized commands to be sent to connected websites.
According to research by cybersecurity firm Patchstack, attackers used valid UpdraftCentral keys to install malicious plugins on WordPress websites.
The commands appeared in the system as legally authorized, allowing plugins to be installed and activated without a regular WordPress administrator login.
The malicious plugins contained backdoor mechanisms designed to gain access to the website. Some were even able to create accounts with elevated privileges that did not necessarily appear as typical administrators.
Patchstack recorded attempts to install malicious plugins on October 18 and 19, while identifying dozens of different names of suspicious plugins.
This means that checking only known administrator accounts is not enough to rule out a potential breach.
Are all 4 million installations at risk?
Not necessarily.
The fact that UpdraftPlus has over four million active installations doesn't mean that all of them have been compromised.
This particular exposed key attack mainly concerns websites that have an active connection to the UpdraftCentral Cloud service.
However, administrators should check their settings even if they don't remember enabling the service. According to Patchstack, logging into a TeamUpdraft account may come with UpdraftCentral enabled by default.
TeamUpdraft says that installations using self-hosted UpdraftCentral are not affected by this breach.
What WordPress administrators should do immediately
TeamUpdraft has published specific security guidelines and now has urgent updates for UpdraftPlus.
Administrators are asked to take the following actions:
Change TeamUpdraft password: Log in directly to teamupdraft.com and set a new, unique password.
UpdraftPlus Update: Install version 1.26.12 for the free version or 2.26.12 for Premium, or any newer version.
Check UpdraftCentral: From your WordPress dashboard go to Settings → UpdraftPlus → Advanced Tools → UpdraftCentral and delete the old login keys.
User Audit: Review all WordPress accounts, not just administrators, for suspicious permissions or unknown users.
Plugin Checker: Look for unknown or recently installed plugins, including Must-Use plugins.
Change administrator passwords: Change the passwords of all accounts with administrative privileges.
Backup Check: If evidence of a breach is found, consider restoring from a clean copy before October 17th, after conducting an appropriate investigation.
The company says that new UpdraftPlus versions automatically disconnect old UpdraftCentral connections created before October 18th, 22:00 PM UK time.
Installing the update, however, does not replace checking for potentially malicious changes that have already been made.
What about UpdraftVault backups?
Users of the UpdraftVault service should also pay attention.
TeamUpdraft proactively disconnected all websites from UpdraftVault and replaced the relevant credentials.
Consequently, scheduled backups will not be sent to UpdraftVault until the connection is restored.
Users should log back in through the UpdraftPlus settings, using their new account password, and perform a manual backup to confirm proper operation.
In contrast, the company said that backups stored on independent services such as Google Drive, Dropbox and Amazon S3 were not directly affected by the TeamUpdraft breach. Websites that may have been compromised via UpdraftCentral are also advised to refresh their access credentials.
TeamUpdraft continues the research
After discovering the incident, the company announced that it had restricted unauthorized access, disconnected user accounts, replaced keys and credentials, and strengthened monitoring of its systems.
In addition, it reported the incident to the competent British data protection authority (ICO) and other competent authorities.
The exact extent of the breach and the total number of websites affected have not yet been publicly determined.
The incident highlights a significant risk to the WordPress ecosystem: even an updated plugin can become an attack vector when the keys to an external remote administration service are compromised.
For WordPress administrators, the priority is clear: update UpdraftPlus, replace old UpdraftCentral connections, and take a serious look at the security of their websites.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
