UpdraftPlus, the WordPress backup plugin running on more than 3 million sites, just told users they could be backdoored even though the plugin’s own code never had a bug.
TL;DR: Attackers compromised TeamUpdraft’s own website over the weekend of October 17 and 18, stealing a customer database that included connection keys for UpdraftCentral, the plugin’s remote management feature. Those stolen keys let attackers send properly signed, legitimate-looking commands that installed malicious plugins and created admin-level accounts disguised as ordinary Editors. UpdraftPlus shipped fixed versions on October 19, and WordPress.org force-pushed the update to affected sites automatically. If your site has an active UpdraftCentral Cloud connection, assume it’s worth checking your user list right now.
Security firm Patchstack, which analyzed the incident, put it bluntly: “This is not a vulnerability in UpdraftPlus, and as of 19 October no plugin update stops it. The commands are correctly encrypted and signed with genuine dashboard private keys. Every check in the plugin passes, because from the site’s point of view the instruction is legitimate.”
A supply-chain problem, not a coding mistake
This distinction matters more than it sounds like it should. A traditional WordPress plugin vulnerability gets fixed by patching bad code. This one can’t be patched that way, because the code was never broken. Attackers got into TeamUpdraft’s own infrastructure, pulled out a customer database that held UpdraftCentral connection keys, and then used those keys exactly as intended: to send remote management commands that any legitimate dashboard would also be allowed to send.
That’s what let the malicious commands sail through every security check UpdraftPlus has built in. The plugin was asked to install a plugin by a request carrying a real, correctly signed key. It did what it was designed to do.
Patchstack found attackers using the access to install one of at least 99 differently named malicious plugins, one disguised under the innocuous-sounding name “Site Health Cache.” Once active, the malicious code created a WordPress user with the Editor role and then quietly granted it extra administrative permissions, enough to install more plugins and change important settings while still appearing to be a regular Editor account in the user list. The backdoor also skipped WordPress’s normal login flow entirely, which meant two-factor authentication and login attempt limits never came into play.
Backup plugins make unusually good targets
There’s a reason this kind of incident keeps landing on backup and management tools rather than, say, a contact form plugin. A backup plugin by design needs sweeping access: it has to read every file on your site, write new files during restores, and often holds credentials for remote storage like Google Drive, Dropbox, or Amazon S3. A remote management layer like UpdraftCentral adds another privileged channel on top of that, one built specifically so an outside dashboard can issue commands to your site.
That combination, broad file access plus a remote command channel, is exactly what makes a stolen key so dangerous here. Compromise a plugin with narrow permissions and an attacker gets a narrow foothold. Compromise the credentials behind a backup and remote management tool and you’ve effectively handed over a master key that was designed to do powerful things on purpose.
Who’s actually affected, and the fix that’s already out
Not every site running UpdraftPlus is exposed. The risk is specific to sites with an active UpdraftCentral Cloud connection, and Patchstack noted that remote management was selected by default when connecting to a TeamUpdraft account, so some site owners using UpdraftPlus purely for local backups may have an active key they never knowingly set up.
TeamUpdraft shipped UpdraftPlus 1.26.13 (free) and 2.26.13 (premium) on October 19, and WordPress.org pushed that update out automatically across the plugin’s install base. The update severs the UpdraftCentral connection on affected sites, cutting off that specific access route. What it doesn’t do is clean up anything attackers already planted. If a malicious plugin or a fake-Editor admin account made it onto your site before the patch landed, updating alone won’t remove it.
Self-hosted UpdraftCentral installations, as opposed to the cloud-connected version, were not affected by this particular breach, according to TeamUpdraft. That distinction alone is worth checking, since plenty of agencies run self-hosted dashboards specifically to avoid depending on a third party’s cloud infrastructure, and this incident is a reminder of why that extra setup effort sometimes pays off.
Related: This lands less than two weeks after a critical PHP remote code execution flaw (CVE-2026-109618/109619) put a different kind of pressure on WordPress site owners, and it mirrors how this week’s ConnectWise breach also started with stolen vendor-side credentials rather than a flaw in the product customers were actually using.
A practical checklist, not just a patch note
Updating the plugin resets the specific access route attackers used, but it leaves the question of what happened while that route was open. Site owners with an UpdraftCentral Cloud connection should go through their WordPress user list manually and look for any Editor-level account they don’t recognize creating it, since that’s the disguise the malicious code used to hide its extra admin permissions in plain sight. Next, check the installed plugins list for anything unfamiliar, paying particular attention to generic, forgettable names, the kind designed to blend in rather than stand out.
Anyone running a security scanner that checks plugin integrity against official repository checksums should run it now rather than waiting for a routine scan cycle. And if your site uses UpdraftCentral purely out of habit rather than active need, this is a reasonable moment to ask whether that remote management convenience is worth the exposure it carries.
The bottom line
If you run UpdraftPlus with UpdraftCentral Cloud turned on, updating to the patched version is step one, not the whole job. Go check your WordPress user list for Editor accounts you don’t recognize, and look for any plugin you didn’t install yourself, especially anything with a generic, forgettable name. The patch closes the door attackers walked through. It doesn’t check whether anyone is still standing in the hallway.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
