Stolen UpdraftCentral Keys Backdoor WordPress Stores

Attackers are using UpdraftCentral keys stolen from TeamUpdraft’s customer database to install backdoor plugins on WordPress sites, according to BleepingComputer.

If your store, blog or agency site runs UpdraftPlus, the backup plugin with more than 4 million active installs, a hidden admin-level account may already exist on it. For the store owners who read Ecommerce Paradise, that covers every WooCommerce operator and every Shopify owner whose blog, landing pages or help center sit on WordPress. The backdoor account survives even after you delete the plugin that created it.

This one is not a code flaw you patch and forget. It is a key theft, so the cleanup is manual, and the order of the steps matters. Below is what happened, the history behind it, what it means for a high-ticket dropshipping operation, and the exact checks to run today.

The TeamUpdraft database held customer billing addresses. Your LLC filing is the other place your address goes public, so form your LLC with Northwest, the best LLC formation service for ecommerce owners. Plaintiffs and regulators read the address on a filing, and Northwest’s registered agent address keeps yours off it. Form your LLC with Northwest →

UpdraftCentral Keys Stolen From TeamUpdraft Now Install Backdoors

Unknown attackers breached the TeamUpdraft website over the weekend of Oct. 17 and 18, 2026, according to The Hacker News. TeamUpdraft develops UpdraftPlus, UpdraftCentral (a dashboard for managing many sites), UpdraftVault (cloud backup storage) and UpdraftClone (staging sites).

The company believes the attackers reached its customer database, per BleepingComputer. That database reportedly held names, email addresses, billing addresses, order history, password hashes, two-factor settings and the connection keys that tie a site to UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft says it holds no financial data because Stripe and PayPal process payments.

The keys are what turned a data breach into a site takeover. Patchstack, a WordPress security firm, said it first saw a backdoor installed on Oct. 18 at 15:32 UTC and logged one continuous campaign of about 18 hours. The attacker sends a genuinely signed plugin.upload_plugin command, WordPress installs and activates the plugin, and every plugin-level check passes because the command is valid.

Patchstack counted 99 distinct backdoor plugin names. They pose as maintenance tools, and the most common description reads “Small maintenance toolkit: keeps option storage tidy.” One name recurs often enough to memorize: “Site Health Cache.”

The backdoor then watches for a secret URL parameter carrying a 32-character token. When it sees one, it creates an account with a hard-coded password, gives it the Editor role, and adds the manage_options and install_plugins capabilities. Patchstack says the visitor is then logged in with a persistent cookie that bypasses the login form, so two-factor authentication and login-protection plugins never run. A newer variant, per Nethemba, can also create a full administrator or sign in as an existing one.

Scale is the number to watch. Per BleepingComputer, about 10% of UpdraftPlus sites hold an UpdraftCentral or Migrator key, which puts roughly 400,000 websites in the exposure pool against a baseline of 4 million installs. Imunify360 reported campaign requests reaching WordPress sites on more than 2,200 servers in its own defense network on the evening of Oct. 18.

TeamUpdraft’s response, as summarized by The Hacker News, was to close the access route, sign out all accounts, replace affected keys and credentials, and report the incident to the U.K. Information Commissioner’s Office. It released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), which automatically disconnect UpdraftCentral connections made before 10 p.m. BST on Oct. 18. Version 1.26.12 was supposed to remove the keys but did not, according to Nethemba and Imunify360.

Second Hit on the Same UpdraftCentral Channel in Five Months

This is the second incident on this remote-command channel in about five months, per Patchstack. In June 2026 TeamUpdraft fixed CVE-2026-10795, an 8.1 severity flaw that let attackers forge UpdraftCentral commands using an obsolete unsigned message format. Fixes shipped in versions 1.26.5 and 2.26.5, and Patchstack says exploitation attempts against older versions continue. A site on an old build faces both problems at once.

The key problem is also older than the breach. Patchstack found that keys issued in November 2025 still worked in October 2026, so they do not expire. A site gets a key either by connecting to an UpdraftCentral dashboard or by linking a TeamUpdraft.com account, and Patchstack says the second route has a checkbox ticked by default. Some owners hold keys they never knowingly created.

There is a real counterpoint, and both sides deserve attribution. TeamUpdraft says the UpdraftPlus plugin files, self-hosted UpdraftCentral dashboards and backups stored on customers’ own remote storage were not affected. Patchstack agrees on the framing, saying in its Oct. 19 write-up that “this is not a vulnerability in UpdraftPlus, and as of 19 October no plugin update stops it.” Wordfence’s exposure test, relayed by The Hacker News, requires both an UpdraftPlus install and an active connection to the cloud-hosted UpdraftCentral. A site that never connected is probably fine, though you should confirm that rather than assume it.

The two statements are about different days. Patchstack wrote before the 1.26.13 release, and the auto-disconnect in that release changes the picture for sites that update. Updating clears the pre-incident keys, but it does not remove a plugin or user the attacker already added.

The timing also overlaps with other WordPress supply-chain trouble this week.

Rank Math PRO version 3.0.123, downloaded between Oct. 15 at 8:02 p.m. UTC and Oct. 16 at 7:12 a.m. UTC, carried malware tracked as CVE-2026-111862 with a 9.8 score, and the fix is 3.0.124, per The Hacker News. I covered that in my Rank Math PRO backdoor breakdown.

PHP also shipped emergency patches on Oct. 21 for two critical remote code execution flaws after details leaked early, per BleepingComputer. I wrote those up in the PHP emergency patch post. An earlier case of hidden admins on WordPress stores is in my Ninja Forms hidden admin coverage.

What 400,000 Exposed WordPress Sites Mean for Your Store

My read is that remote-management keys are admin passwords that never expire, and most owners treat them like a convenience setting. This incident is the proof. A backup plugin is the one tool trusted with full copies of your database and files, so a compromise there is worse than a compromise in a contact form.

Start with where your revenue actually runs. If checkout lives on Shopify, the backdoor cannot touch your orders, payment tokens or customer accounts. That is a real advantage of a hosted platform, and I explain the tradeoffs in my WooCommerce hosting comparison. The risk for a Shopify owner sits in the WordPress blog or content site feeding it traffic. An Editor account with unfiltered HTML can inject JavaScript that runs in an administrator’s browser, redirect visitors, or plant spam pages that get the domain flagged.

If you run WooCommerce, the exposure is direct. The attacker’s account can install arbitrary code, and arbitrary code on a store with customer orders is a data-handling problem and a downtime problem at the same time.

Here is hypothetical math, labeled as such. Say content pages drive 20 of your 60 monthly orders at a $1,800 average. A two-week blacklisting that halves that traffic costs about 10 orders, or $18,000 in revenue, before cleanup time. Run your own numbers, because the point is how fast a quiet blog turns into a real line item. The same logic applies if your site goes down to restore from backup during your Black Friday build.

There are three scenarios, and the thresholds are simple. If wp option get updraft_central_localkeys returns nothing and you never used UpdraftCentral, you are likely clear, but update anyway. If it returns keys and you find no unknown plugins or users, delete the keys, rotate passwords and move on. If you find a plugin you did not install or an Editor you do not recognize, treat the site as fully compromised and restore from a clean backup taken before Oct. 17.

Hosting choice matters here more than most owners admit. A managed host that keeps restore points outside your WordPress install gives you a clean rollback even when a plugin you trusted turns hostile. I would ask any host three questions: where restore points are stored, how long they are kept, and whether you can restore one file set without touching the database. Cloudways is one managed option I compare. SiteGround is another.

Liquid Web is a third. My Cloudways vs SiteGround breakdown shows how the first two differ on pricing. Check each answer yourself before you move anything.

If a database with your billing address and email sat in TeamUpdraft’s records, change anything that reuses that password and consider identity monitoring such as Identity Guard. Expect phishing emails posing as TeamUpdraft, which the company itself warns about.

The bigger lesson is operational. A store with one person who knows the plugin list is one breach away from a bad week. That is why I built the turnkey done-for-you service, where a team owns the stack, the audits and the restore plan so you are not learning WP-CLI commands at midnight. My earlier piece on security infrastructure for high-ticket stores covers the structure I would put in place first.

Not sure whether your plugin stack is exposed? Bring your plugin list into the Skool community and compare notes with other store owners and me. Join the Skool community →

Remove UpdraftCentral Keys and Backdoor Accounts Today

Work through these six steps in order. Do the key deletion first, because every other step is pointless while the key still opens the door.

Check for keys. Run wp option get updraft_central_localkeys on every WordPress site you own, including the ones you forgot. Any output means the site is exposed, even if you never meant to use UpdraftCentral.
Update UpdraftPlus to 1.26.13 or later (Premium 2.26.13 or later), then delete the keys under Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral, or run wp option delete updraft_central_localkeys. Backups keep working after deletion, and removing the site from the dashboard is not enough.
Look for unknown plugins on disk, not just in the admin screen. Run ls -lt wp-content/plugins wp-content/mu-plugins and look for anything added on Oct. 18 or 19, plus the “Site Health Cache” name. Patchstack warns against repairing a broken backdoor, because fixing the error switches it on, so move it out of the web root.
List users without loading plugins: wp user list --role=administrator --skip-plugins and the same for editors. Treat any editor you did not create as suspicious, especially one named “Site Tools” or with an example email address.
Reset administrator passwords, run wp config shuffle-salts to end every session, and enable two-factor authentication. Lock your domain and turn on two-factor at your registrar, such as Namecheap, so a stolen session cannot become a stolen domain.
If anything looks wrong, restore from a backup taken before Oct. 17, then repeat steps 2 and 5, because the restore brings back the old version and old passwords. Rotate your remote storage keys too.

Then put a repeating task on the calendar. A virtual assistant hired through OnlineJobs can run the plugin and user audit monthly from a one-page checklist.

The same checklist belongs in the continuity plan I outlined for e-commerce stores. If you want a second set of eyes on your stack before the holiday rush, book a call at my discovery page.

Frequently Asked Questions

Does this affect my Shopify store directly?
No. Shopify checkout, orders and customer accounts are not on WordPress. The exposure is a WordPress blog or marketing site connected to the store, and I walk through the platform split in my guide to launching a high-ticket business in 2026.

I updated UpdraftPlus already. Am I safe?
Not necessarily. Per Imunify360, the update removes pre-incident keys, but a plugin or Editor account added before you updated stays in place. Run the plugin and user checks as well.

How do I know if I have a key without opening the dashboard?
Run wp option get updraft_central_localkeys over WP-CLI. Patchstack says any output means the site is exposed, and it recommends checking even if you never used UpdraftCentral.

Do I have to tell customers?
It depends on whether the backdoor reached customer data, and on your state’s breach-notification rules. I am not a lawyer, so ask counsel before you send anything. If notice is required, an email platform like Klaviyo can send it quickly.

Should I drop UpdraftPlus entirely?
That is your call. TeamUpdraft and Patchstack both say the plugin itself was not the flaw, so the practical rule is simpler: do not leave remote-management keys active on a store you do not manage remotely. A separate protection for payment failure is in my payment processor backup plan.

What else should I patch this week?
Rank Math PRO to 3.0.124 or later, and PHP to the emergency release your host publishes. If you sell through a custom checkout, my notes on hijacked Shopify apps and fake checkouts are worth a read.

I am still choosing a niche. Does this change anything?
No, but it is a reason to pick a platform setup you can run without constant patching. My free niches list is the place to start. The high-ticket niches guide goes deeper.

Want my team to build and run your high-ticket store so a plugin breach is their problem, not yours? See the turnkey done-for-you service →

I will keep tracking the UpdraftCentral cleanup as TeamUpdraft and Patchstack publish more. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

If this was useful, these go deeper:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.