WordPress site owners are being told to check for a silent intruder after TeamUpdraft, the company behind the world's most popular WordPress backup plugin, confirmed that attackers stole the private keys used to manage sites remotely — and turned them into a backdoor.
The stolen keys belong to UpdraftCentral, TeamUpdraft's remote site management service, whose client ships with every copy of UpdraftPlus — a plugin with more than four million active installations. According to Slovak security firm Nethemba, which discovered the campaign on its own servers, an attacker used the valid keys to push malicious plugins onto connected WordPress sites in the early hours of October 19. Nethemba CEO Pavol Luptak said the commands were signed with keys that had never been stored on the firm's own servers: "Whoever holds them can install and run arbitrary code on every connected site without the owner knowing."
Security firm Patchstack, which rated the incident a critical 9.8 on the CVSS scale, observed backdoor installations running continuously from 15:32 on October 18 to 09:23 on October 19, and counted 99 different malicious plugin names. One recurring backdoor description was innocuous-sounding: "Small maintenance toolkit: keeps option storage tidy."
Not a plugin bug — so no update fixes it
The alarming part for site owners is that this is not a vulnerability in UpdraftPlus itself. The attacker's commands are correctly encrypted and signed with genuine dashboard private keys, so every security check inside the plugin passes — the site treats the instructions as legitimate. Current releases 1.26.11 and 2.26.11 are affected exactly like older ones, and updating the plugin does not stop the attack. Patchstack has deployed mitigation rules that block UpdraftCentral remote commands, but the real fix is deleting the UpdraftCentral keys stored on each site.
Nethemba ran through every site-side explanation before going public: its sites ran the fully patched WordPress and UpdraftPlus releases, the plugin files were byte-for-byte identical to the official download, and no unauthorized administrator appeared in the logs. The requests also carried the wrong fingerprint — genuine UpdraftCentral traffic identifies itself with a library version and a teamupdraft.com URL, while these commands came from the attacker's own server.
TeamUpdraft confirms a weekend breach
TeamUpdraft confirmed the breach in a blog post on Monday, October 19. Head of Product Joe Whittaker said the company detected unauthorized access to teamupdraft.com over the weekend of October 17–18, closed the access route, signed out every account, and replaced keys and credentials. But the customer database is believed to have been accessed — including names, email and billing addresses, order history, hashed passwords, two-factor settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.
The company disconnected every UpdraftVault site and replaced all UpdraftClone client keys, so customers of those services will need to reconnect. It has reported the incident to the UK's Information Commissioner's Office. The entry point remains unexplained; Whittaker said only that the team had "deployed a fix for the underlying weakness."
What site owners should do now
Security researchers advise checking Settings → UpdraftPlus → Advanced Tools → UpdraftCentral for any "Command received" log entries the owner did not trigger, and deleting any listed key under "Manage existing keys." Site owners should also scan the Plugins list for unfamiliar entries — especially ones dated October 18 or 19 — and review the Users list for unknown administrators. One backdoor variant hides its admin user from the Users list entirely, so a deep clean may require inspecting files and the database directly. Regular backups to cloud storage keep working normally regardless of the UpdraftCentral key.
