WordPress Backup Vendor TeamUpdraft Breached, Customer Connection Keys Used to Backdoor Sites

TeamUpdraft, the developer behind the popular UpdraftPlus WordPress backup plugin (over four million active installations), says it found unauthorised access to its teamupdraft.com website over the weekend of 17-18 October. Unknown attackers are believed to have accessed its customer database and potentially obtained connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. These keys were then used to backdoor WordPress sites. UpdraftCentral is a remote management service for running multiple sites, and a client component ships inside every copy of UpdraftPlus.

TeamUpdraft says it closed the access route, signed out every account and replaced keys and credentials that could have been affected. It also released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which automatically disconnect every UpdraftCentral connection made before 10 p.m. BST on 18 October 2026, so the old keys no longer work. The company says no financial information was exposed, as payments are handled by Stripe and PayPal. It also says the UpdraftPlus plugin, self-hosted UpdraftCentral and backups sent to customers' own remote storage are not affected.

Users with a teamupdraft.com account should change their password immediately (and anywhere it was reused), reset 2FA settings, and be wary of unexpected emails claiming to be from TeamUpdraft. Because the connection keys can send commands to connected sites, cloud UpdraftCentral customers are urged to follow the vendor's remediation steps quickly. If a site was accessed through UpdraftCentral, TeamUpdraft also advises re-authorising remote storage and changing storage access keys as a precaution.