Does Your Business Website Use UpdraftPlus? The 15-Minute Check After the UpdraftCentral Key Theft

UpdraftPlus is a widely used WordPress backup plugin, and a legitimate one. TeamUpdraft says the plugin itself and its downloads were not changed. The keys that matter here are for UpdraftCentral, the remote dashboard that can send instructions to a connected site. This page is how an owner confirms the site was checked.

It is for an owner or office manager at a business of about 5 to 50 people. A freelancer, an agency, or a host usually runs the website. You can do this with one email.

The short answer

Was my business website affected by the UpdraftPlus / UpdraftCentral breach? Possibly, if your WordPress site runs UpdraftPlus and was ever connected to UpdraftCentral or a teamupdraft.com account. Patchstack says the keys leaked from the UpdraftCentral Cloud environment and were used to install backdoor plugins on connected sites on October 18 and 19, 2026. The fix is UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium). Those versions revoke the old keys. TeamUpdraft says the extent of what was added is unknown, so check for unexpected plugins and users.

What happened (briefly)

TeamUpdraft says it found unauthorized access to teamupdraft.com over the weekend of October 17 and 18, 2026. "We believe our customer database was accessed." That database includes connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Passwords were stored only as hashes. TeamUpdraft does not store card details. "The UpdraftPlus plugin itself and its downloads were not affected."

Patchstack saw backdoor plugins installed on connected sites on October 18 and 19, and counted 99 distinct plugin names. CSO Online reported at least 99 variants, and reported that Nethemba's three sites were targeted, with plugins installed on two of them.

Patchstack and CSO Online both describe UpdraftPlus as having over four million active installations. Only sites with an active UpdraftCentral key were exposed to this route.

On October 19, just after 10pm BST, TeamUpdraft published the fix: UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium). The update revokes UpdraftCentral connection keys, and WordPress.org pushed it to all users.

Are we in scope?

Does the site run UpdraftPlus? Ask the person who built it, or look in Plugins.
Was it ever connected to UpdraftCentral or a teamupdraft.com account? Patchstack says the teamupdraft.com connection screen enrolled sites in UpdraftCentral by default, with the checkbox already ticked. "We never used UpdraftCentral" does not prove the key is absent. TeamUpdraft's October 21 update at 15:35 BST tells Premium users: "This is worth checking even if you've never used UpdraftCentral."
Did the site show errors (HTTP 500) around October 18 and 19? Patchstack says early samples crashed sites, which is how the first ones were noticed.

Any yes, or any unknown, is a reason to send the questions below.

Why the update doesn't finish the job

The update revokes the old key. It leaves anything already added on the site. TeamUpdraft says the connection was used "to create admin accounts, install malicious plugins etc" and that "the extent of that is unknown so it's important to check your sites." CSO Online reports that revoking the key "does not automatically remove rogue plugins, accounts or active sessions."

The check your designer or host should do

Ask for notes, not a verbal "it's updated."

Confirm the version and delete leftover keys

The site should be on 1.26.13 (free) or 2.26.13 (Premium), or later. Then delete leftover keys under UpdraftPlus, Advanced Tools, UpdraftCentral. Patchstack says removing the site from the UpdraftCentral dashboard is not enough. The key on the site is the one that matters. Scheduled backups keep working after that deletion.

Look at every user, not just administrators

Patchstack says the added account shows as an Editor. It also has separate permission to install plugins and change settings. A list of Administrators misses it. The account signs in with a cookie, so a two-factor prompt on the login form never runs, and the account stays after the plugin is removed. Patchstack describes usernames made of two words plus two digits, the display name "Site Tools," and an email at example.org. Ask for every user, with a name you recognize beside each one.

Look at every plugin, including Must-Use

TeamUpdraft says to open the Must-Use tab as well. Those plugins sit on their own list. Patchstack says every sample so far uses the description "Small maintenance toolkit: keeps option storage tidy." One reused name is "Site Health Cache." Ask which plugins your team installed, including Must-Use.

Change passwords

Change every site administrator password and the teamupdraft.com password. Type teamupdraft.com into the browser rather than following an email link. If that account uses two-factor authentication, reset it there. Keep the new passwords in the company password manager. The rollout checklist is the setup.

If the site stored backups elsewhere

TeamUpdraft says copies in your own storage, such as Google Drive, Dropbox, or Amazon S3, were not affected. If the site was reached through UpdraftCentral, re-authorize that storage and change its keys.

If something is found: restore, don't patch

Patchstack's advice is to treat the site as compromised and restore it. TeamUpdraft and CSO Online both point to a backup taken before October 17. After the restore, change passwords and end open sessions.

Give the designer this handoff. Patchstack says to delete the UpdraftCentral key first, then move the unexpected plugin out of the web root rather than deleting it in the WordPress admin screen, because its uninstall step erases traces. Leave the plugin's error as it is. Patchstack says repairing the error turns the plugin on.

The first 60 minutes after a cyber incident is the first-hour list. A 15-minute backup test is how you confirm a restored file opens.

Questions to send your web designer or host today

Does our site run UpdraftPlus, and which version?
Was it ever connected to UpdraftCentral or a teamupdraft.com account? Are those keys deleted now?
Did you check every user, including Editors, and every plugin, including Must-Use?
Did you change all admin passwords and our teamupdraft.com password?
Do we have a clean backup from before October 17, and where is it stored?
Who holds admin logins to our site today? The questions for your IT host ask the same kind of question about named access.

Date sent: YYYY-MM-DD · Answer received: · Checked by:

The evergreen habit

Know who can log in as an administrator, and which plugins can be controlled from outside the site. Add the website to the monthly patch routine and the month-end security hub. An offline backup spot-check still applies to the copy you would restore from.

FAQ

Didn't the automatic update fix it? It closed the route. It does not remove anything already planted. CSO Online reports that revoking the key does not automatically remove rogue plugins, accounts, or active sessions. Patchstack found the account shows as an Editor rather than an administrator, so the check has to cover every user and every plugin, including Must-Use plugins.

What should I ask my web designer to do? Confirm UpdraftPlus is on 1.26.13 (free) or 2.26.13 (Premium), or later, delete any leftover UpdraftCentral keys, review every user (including Editors) and every plugin, change all admin passwords and the teamupdraft.com password, and restore from a backup taken before October 17 if anything unexpected turns up.

Related guides

Educational content only — not legal, insurance, or compliance advice.