On this page (8 sections)
Patchstack reports that an attacker in possession of valid UpdraftCentral dashboard keys is installing backdoor plugins on WordPress sites linked to that service. In Patchstack's analysis, the campaign ran without a break across an 18-hour window on 18-19 October 2026.
If your WordPress site runs UpdraftPlus, particularly if you ever connected a TeamUpdraft.com account, check it today. Only one independent publisher has covered this so far, so details may shift as the vendor and other researchers add information.
What happened
UpdraftCentral is a separate remote management service from TeamUpdraft, but its client is bundled in every copy of UpdraftPlus. It does nothing until the site receives a key. After that, the site obeys any command signed with the dashboard's private key, running with the permissions of whoever set up the connection. No one confirms individual commands.
Patchstack says the attacker sends correctly signed commands that upload and activate plugins, and that every plugin delivered this way is a backdoor. Since the signatures are genuine, the plugin's own checks all succeed. Patchstack states that the newest releases, 1.26.11 and 2.26.11.26, behave the same as older ones.
Nethemba found the campaign on its own infrastructure and released the first analysis, according to Patchstack, which says its results agree with Nethemba's and widen the observed scope.
Why this is not an ordinary plugin bug
Nothing in the plugin is being fooled. Per Patchstack, Nethemba excluded site-side causes: plugin files were identical to the official release, key fingerprints did not change across days of backups, and logs showed no unauthorized administrator or plugin upload. The requests also originated from the attacker's own server, not from vendor systems.
That points toward the dashboard private keys leaking from the UpdraftCentral Cloud environment, where they are kept and never reach connected sites. Patchstack says TeamUpdraft had offered no explanation when the post first went live, and later added a link to a TeamUpdraft security incident post. We have not reviewed that post, so read the vendor's own statement for its account of the cause.
Who is realistically exposed
Any site holding an active UpdraftCentral key. Patchstack stresses you may hold one without realizing it. Connecting a TeamUpdraft.com account displays a checkbox, ticked by default, reading "Add this website to UpdraftCentral (remote, centralised control) - free for up to 5 sites". Leave it ticked and a successful login creates a key. The box only shows when the site has no key, so a single account connection is enough to enroll a site that never knowingly used UpdraftCentral.
If you manage many client sites, work out which of them ever connected to UpdraftCentral or to a TeamUpdraft.com account, because the default checkbox makes this easy to forget.
How the backdoor behaves
Patchstack describes the commands as POST requests to the site root, sent over the plugin's remote procedure call channel with a plugin.upload_plugin command that WordPress handles through its normal installer. The delivered plugin hooks into WordPress early on every request and looks for a secret URL parameter holding a 32-character token. When it sees the token, it creates an account with a hardcoded password, gives it the Editor role, and then separately grants that account manage_options.
The research available to us stops at that point, so we cannot describe anything the backdoor does afterward. For defenders, the practical signals are plugins you did not install, accounts you did not create and unexpected capability changes.
How to check your site
Begin with what is installed and who can log in. The two WP-CLI commands below are read-only. Run them from the WordPress root as the site user, and look for plugins you do not recognize and for recently created accounts.
wp plugin list --fields=name,status,versionwp user list --fields=ID,user_login,user_email,roles,user_registeredAlso look in the plugins directory for folders with recent modification times you cannot explain, and review web server access logs for POST requests to the site root since 18 October 2026. An unfamiliar plugin, or an unknown account with elevated rights, should be treated as a compromise.
What to do now
Patchstack's advice is plain: delete your UpdraftCentral keys, because no plugin update stops this, and updating UpdraftPlus on its own is not a remedy. The situation was still changing on 19 October, so confirm current instructions in TeamUpdraft's incident post.
0 of 8 done
For cleanup guidance, see our guide on what to do when a website is hacked and the WordPress security checklist.
Detection and monitoring afterwards
Keep watching for new plugins, new privileged users and unexpected file changes for several weeks, since a token-triggered backdoor can stay quiet. An outside-in scan can reveal some symptoms but cannot see inside your server, as explained in what outside-in malware detection can and cannot see. The free malware scanner can serve as one extra signal alongside the server-side checks above.
Longer term, treat any remote management channel as a trust relationship. Whoever holds the signing keys can act as an administrator on every connected site, so enable such channels only where you need them and review them regularly.
Timeline
| Date (2026) | Event |
|---|---|
| 18 October, 15:32 | First observed activity |
| 18-19 October | Campaign runs continuously through an 18-hour window |
| 19 October, 8:00 UTC | Patchstack reports the campaign active and no vendor fix |
| 19 October, 13:00 UTC | TeamUpdraft publishes a security incident blog post |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.