On 26 October 2026 Check Point Research summarised the week’s top breaches. One of them was this: WordPress backup developer TeamUpdraft suffered a cyberattack after intruders accessed its website and potentially exposed customer information and management-service connection keys. Attackers then abused compromised UpdraftCentral keys to install backdoors on WordPress websites during an 18-hour campaign on 18 and 19 October (1). That is the same pattern we covered with ConnectWise Cloud Backup weeks earlier — a trusted backup tool becoming the way in — except this time the target is WordPress, which powers a huge share of small-business websites (10).

What happened?

TeamUpdraft makes UpdraftPlus, a WordPress backup plugin with more than four million active installations. It also runs UpdraftCentral, a cloud remote-management service. A client for that service ships inside every copy of UpdraftPlus (2)(3).

The breach: over the weekend of 17–18 October 2026 TeamUpdraft identified unauthorised access to teamupdraft.com. It closed the access route, signed out every account and replaced keys and credentials that could have been affected (2).

What may have been exposed: TeamUpdraft believes its customer database was accessed. That database holds names, email addresses, billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card payments are handled by Stripe and PayPal; TeamUpdraft says it does not store card details (2).

What was not hit: the UpdraftPlus plugin downloads themselves were not affected, nor was self-hosted UpdraftCentral, nor backups sent to a customer’s own remote storage (Google Drive, Dropbox, Amazon S3 and the like). If a site was reached through UpdraftCentral, TeamUpdraft still asks customers to re-authorise remote storage and change storage access keys as a precaution (2).

How they got in (vendor’s account): according to TeamUpdraft, the attacker used a compromised key to reach its site, and the speed of follow-on exploits plus initially faulty backdoor plugins suggest AI was used to accelerate the attack. The company has brought in an external cyber security firm, contacted the police and reported the incident to the Information Commissioner’s Office (ICO) (2).

Stolen keys, signed commands, backdoor plugins

Once the keys were out, attackers did not need a flaw in your WordPress setup. Slovakia-based firm Nethemba was first to publish a detailed analysis after an attacker pushed unknown plugins to its own sites. The commands were signed with valid UpdraftCentral dashboard keys that had never been stored on Nethemba’s servers. Whoever holds those keys can install and run code on every connected site without the owner knowing (5).

Patchstack’s telemetry recorded backdoor installations across a broad set of sites between 15:32 on 18 October and 09:23 on 19 October — about 18 hours — involving 99 distinct backdoor plugin names (3)(4). The attacker sent a signed plugin.upload_plugin command over the plugin’s remote procedure call channel; WordPress then installed and activated the supplied plugin through its normal installer (3).

Early backdoors were buggy and crashed sites with HTTP 500 errors — which is how many owners noticed. The attacker then deleted the broken plugins and uploaded working versions that created accounts (sometimes with Editor role plus extra rights, sometimes logging in as an existing administrator) (3)(5). Observed source addresses include 43.250.53.42 and an IPv6 address reported by Nethemba and Wordfence (3)(5)(6).

Keys nobody knew were there

Sites without an UpdraftCentral connection key do not accept these commands (6). But you did not need to think you were “using” UpdraftCentral to be exposed. Reporting from The Repository and Patchstack describes a TeamUpdraft login screen checkbox, ticked by default, that adds the site to UpdraftCentral. Leave it ticked and a key that does not expire can be created — including on sites connected only for licensing or updates (4). Hosts and agencies have reported finding old keys “just lying around” from years earlier (4).

This is the second serious UpdraftCentral-channel incident in five months. In June 2026 the vendor fixed CVE-2026-10795, where an obsolete unsigned message format let attackers forge commands with no keys at all. Sites below the fixed versions face both problems at once (3)(6).

What TeamUpdraft has done — and what you must still do

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which automatically disconnect UpdraftCentral connections made before 13:07 BST on 18 October so old keys stop working. An earlier same-day build, 1.26.12 / 2.26.12, was meant to revoke keys but, according to Nethemba’s code review, deleted none because of a bug; 1.26.13 fixed that. WordPress.org pushed the update out; TeamUpdraft still asks every site to update and to delete the connection key by hand (2)(4)(5).

It also disconnected every site from UpdraftVault and issued new credentials, replaced every UpdraftClone client key, rotated payment-provider keys, and put extra monitoring in place (2). Wordfence and Patchstack issued emergency firewall rules blocking UpdraftCentral command traffic for their customers while keys were retired (6)(4).

The real lesson: your backup supplier is inside your attack surface

Nobody had to guess a site owner’s password. The attacker presented a trusted vendor key and the plugin did what it was designed to do: accept signed remote commands. That is the same lesson as the ConnectWise Cloud Backup incident we covered earlier this month — a backup product granted deep access so it can protect you, and that access becomes the door if the vendor’s credentials leak (10).

  • Deep access is the point — and the risk: backup and remote-management tools often hold keys that can change your site or tenant without a human logging in. Treat them like admin accounts.
  • Dormant connections still count: a key created years ago for licensing, or by a default tick-box, can still work until someone deletes it (4).
  • MFA protects people, not vendor keys: MFA on your WordPress users does not stop a signed UpdraftCentral command that installs a plugin or creates an account (3)(5).
  • Shared responsibility: host, web agency, backup vendor and you each need a named role for who reviews plugins, keys and admin accounts — and how fast you react when the vendor says “check your sites today”.

The compliance and GDPR angle

WordPress sites routinely process customer, staff or membership personal data. Under UK GDPR:

  • Article 32, security of processing: you must have appropriate technical and organisational measures to protect personal data, including a process for regularly testing and evaluating them (7). Leaving a remote-management key you did not know existed, or failing to act on a vendor’s incident notice, is hard to square with that duty.
  • Article 28, contracts with processors: if a host, web agency or SaaS backup/management provider handles personal data on your behalf, there must be a written contract covering security measures, sub-processors and help if there is a breach (8)(9). That contract is also where “who reviews admin accounts and plugin keys, and how often” should be clear — the gap the ICO criticised in the Password1 / Data Cymru reprimands.

TeamUpdraft has reported this incident to the ICO (2). That does not remove your own duties as a controller for the personal data on your website.

How we handle this with MSL Care Complete

MSL Care Complete, our full managed support package, is built so these questions already have answers. It includes proactive monitoring, patching with Action1, Huntress managed EDR, documentation of your IT setup, a quarterly IT review and a written client agreement, agreed with each client, covering data protection terms, DPIAs (data protection impact assessments), GDPR policy and procedures. That documentation records your suppliers — including your website host, web agency and backup tools — so when a vendor like TeamUpdraft says “check every site”, we know what you run and who to chase. It comes at a fixed monthly price, no surprises. MSL is registered with the ICO (ZC279345).

Your checklist

  • List every WordPress site your business owns or relies on (including ones an agency manages for you).
  • Confirm UpdraftPlus is on 1.26.13 / 2.26.13 or later, and that any UpdraftCentral key has been deleted and only recreated after a clean check (2)(5).
  • Search Users and Plugins (including Must-Use) for anything you did not create; rotate admin passwords (2).
  • If you use UpdraftVault or UpdraftClone, reconnect with the new credentials TeamUpdraft issued (2).
  • Change your teamupdraft.com password and reset 2FA; treat unexpected “vendor” emails with caution (2).
  • Confirm you have a written data-protection contract with your web host/agency covering security and breach help (8)(9).
  • Ask who owns plugin and remote-management reviews — and put that name in your IT documentation.

Check each WordPress site today (vendor guidance)

  1. Log in to the site’s own dashboard — not through UpdraftCentral (2).
  2. Update UpdraftPlus to 1.26.13 / 2.26.13 or later (not only 1.26.12) (2)(5).
  3. Delete the UpdraftCentral connection key under Settings → UpdraftPlus → Advanced Tools (2).
  4. Check Users for accounts you don’t recognise; remove them (2).
  5. Check Plugins (including Must-Use) for anything unfamiliar; remove it (2).
  6. Change all administrator passwords; if anything looks wrong, restore from a backup taken before 17 October (2).

When your backup vendor is the way in, supplier documentation is the real test.

References

  1. Check Point Research, “26th October – Threat Intelligence Report”, 26 Oct 2026
  2. TeamUpdraft, “TeamUpdraft security incident: What customers need to know”, Joe Whittaker, 19 Oct 2026 (updated 23 Oct 2026)
  3. The Hacker News, “Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites”, Ravie Lakshmanan, 21 Oct 2026
  4. The Repository, “Attacker Uses Stolen UpdraftCentral Keys to Backdoor WordPress Sites After TeamUpdraft Breach”, Rae Morey, 20 Oct 2026
  5. Nethemba, “Critical security problem in UpdraftCentral: an attacker holding the service's keys planted a backdoor on our websites”, Pavol Lupták, Oct 2026
  6. Wordfence, “PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites”, 19 Oct 2026
  7. UK GDPR, Article 32: Security of processing (legislation.gov.uk)
  8. UK GDPR, Article 28: Processor (legislation.gov.uk)
  9. Information Commissioner's Office, “What needs to be included in the contract?”
  10. MSL blog, “When the backup tool becomes the way in: what the ConnectWise Cloud Backup attack teaches small businesses about Microsoft 365 apps”, Oct 2026

Need a hand applying any of this to your business? Get in touch — call +44 1472 564538 or email services@msl.org.uk.

← Back to Insights