TeamUpdraft (UpdraftPlus/UpdraftCentral): website breach exposed connection keys used to install backdoor plugins on WordPress sites (no CVE)
Severity: critical · Patch status: patched · Since 2026-10-21
Unknown attackers breached teamupdraft.com over the weekend of Oct 17-18, 2026, accessing the customer database including hashed passwords, 2FA settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Patchstack observed the attacker using valid UpdraftCentral dashboard keys to send signed plugin.uploadplugin commands that installed backdoor plugins on connected WordPress sites, creating rogue admin/editor accounts (e.g. 'data-ops43') persisting even after plugin removal. TeamUpdraft disconnected all pre-Oct 18 connections, reset keys and credentials, released UpdraftPlus 1.26.13/2.26.13, reported to the ICO, and advises users to rotate passwords, 2FA, and storage keys. The UpdraftPlus plugin itself and self-hosted UpdraftCentral are not affected.
What to do
- Log in to each site's WordPress dashboard directly (not via UpdraftCentral), update UpdraftPlus to 1.26.12+/2.26.12+, and delete the UpdraftCentral connection key under Settings > UpdraftPlus > Advanced Tools
- Check Users and Plugins (including Must-Use) for unknown admin accounts or rogue plugins (e.g. Site Health Cache, Query Shelf, Wp Forge; accounts like system_team850, web.tech988) and remove them; change all admin passwords
- Check for the backdoor user 'data-ops43' / 'Site Tools' and IOCs (IPs 43.250.53.42, 2a09:bac5:4e21:); if found, restore from a pre-Oct 17 backup
- Change teamupdraft.com password and reset 2FA; change reused passwords elsewhere; re-authorise remote storage and rotate storage access keys
- UpdraftVault users: reconnect sites with new credentials; UpdraftClone users: copy new client keys from My Account > UpdraftClone > Key Management; beware phishing emails posing as TeamUpdraft
Fixed versions
- UpdraftPlus 1.26.13 (free) / 2.26.13 (Premium)
Sources
All live incidents on Threat Watch
