What happened
A data leak, not a code vulnerability. TeamUpdraft detected unauthorized access to its site over the weekend of October 17-18. The customer database was compromised: names, email addresses, billing addresses, order history, hashed passwords, two-factor authentication settings, and the connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. No credit card data was stored. With these keys, the attacker sends commands to sites as if they came from you, including installing an extension. Patchstack and Nethemba confirm: this is not a flaw in UpdraftPlus code, and no CVE number has been assigned.
Timeline. Patchstack detected the first attack on October 18 at 15:32 UTC. On October 19 at 07:17, the IT-Connect site, running UpdraftPlus Premium 2.26.11, received a command to install a fake extension. The same day, TeamUpdraft released version 1.26.12, then 1.26.13 shortly after 22:00 London time. On October 22, the developer added a recommendation: check your TeamUpdraft account for sites listed under UpdraftCentral that you haven’t connected yourself since October 19.
What was not affected, according to the developer. The extension’s code and downloads, backups stored in your own storage (Google Drive, Dropbox, S3…), and self-hosted UpdraftCentral installations.
Who is exposed
Any site with an active UpdraftCentral key, regardless of its version. Free or Premium: TeamUpdraft, Patchstack, and Nethemba confirm both are affected. The option to add a site to UpdraftCentral is checked by default when linking UpdraftPlus to a TeamUpdraft account, and these keys never expire: Patchstack observed a key created in November 2025 still working. BleepingComputer estimates around 10% of UpdraftPlus sites have an UpdraftCentral or migration key, roughly 400,000 sites, without citing a source.
How to check. Settings, UpdraftPlus, Advanced Tools tab, UpdraftCentral: if a key is listed, the site is exposed. With command-line access, the command `wp option get updraft_central_localkeys` will return a result in the same case.
Steps to take, in order
1. A copy of the current state. Files and database, off the server. It serves as evidence, not a restoration point: if the site is compromised, this copy is too.
2. Connect directly and update. Log in to your site’s administration panel (not from UpdraftCentral) and install version 1.26.13, or 2.26.13 if you have Premium, or a newer version. Avoid 1.26.12: due to a bug, it revoked no keys. Version 1.26.13 revokes keys created before the incident.
3. Delete the key, all keys. In the UpdraftCentral tab under Advanced Tools, remove each key from the list of existing keys. Simply removing the site from your UpdraftCentral dashboard is not enough. Nethemba reports that keys created on October 18 between 12:07 and 21:00 UTC may not have been revoked by the update, which the editor has not confirmed: to be safe, delete them manually. Also delete the migration key if you’re not using it. In the command line, these are the options updraft_central_localkeys and updraft_migrator_localkeys.
4. If a fake plugin is present, remove the key first. The attacker reuses the keys: as long as the key exists, they can reinstall the plugin after your cleanup. Delete the key, then disable the suspicious plugin and move its folder outside the site (without deleting it from the admin panel—its uninstall script removes its traces—and without fixing its code if it causes errors). The identification of fake plugins and hidden accounts is detailed in my verification guide.
5. Delete unknown accounts. Fake plugins create an Editor who can install plugins, named in the format data-ops43, displayed as « Site Tools », with an @example.org email. It remains even after the plugin is deleted.
6. Change passwords and secret keys. The teamupdraft.com account, by typing the address yourself rather than clicking a link received via email, every reused password, and those of all administrators. Then the secret keys in wp-config.php, which close all open sessions, and the two-factor authentication, which must be reset. In Premium, Nethemba also advises removing the saved teamupdraft.com password from the plugin.
Are your backups healthy?
Those in your storage are unaffected by the breach. TeamUpdraft confirms this for backups stored on Google Drive, Dropbox, or S3. But if UpdraftCentral accessed your site, the editor asks you to reauthorize remote storage and change its access keys.
A backup made after the intrusion may contain the backdoor. If a fake plugin was installed on October 19, the automatic backup the next day copied it. To restore, use a backup from before October 17.
A backup from before October 17 still contains the old key. WP Staging reminds you: after restoration, delete the UpdraftCentral key again and redo the password and secret key changes. The step-by-step guide is in my restoration guide.
UpdraftVault: log in again. All sites have been logged out. In the UpdraftPlus settings, under the UpdraftVault section, log in with the new password, save, then run a manual backup to ensure everything is back up and running.
Should UpdraftCentral be reconnected?
Not yet. Patchstack advises waiting for the editor to explain the source of the leak; in the latest update to their post, TeamUpdraft indicated that the investigation is still ongoing. If you manage multiple sites and remote management is essential, create the new key under an account that cannot install plugins. For further steps, Nethemba suggests blocking any request containing udrpc_message and preventing PHP from writing to the plugins directory—this should be handled by your hosting administrator.
Frequently Asked Questions
Is the free version of UpdraftPlus affected?
Yes, as soon as an UpdraftCentral key is active. On the morning of October 19th, before the patches, IT-Connect thought not; since then, the editor, Patchstack, and Nethemba have stated that both versions are affected.
Should UpdraftPlus be uninstalled?
No: the plugin’s code is not at fault. Update it, remove the UpdraftCentral key, and keep your backups. If you don’t use remote management, simply don’t reactivate it.
Is this the same as the CVE-2026-10795 vulnerability?
No. That vulnerability, fixed in June 2026 in versions 1.26.5 and 2.26.5, allowed commands to be forged without a key. It is unrelated to the October leak but affects the same sites—another reason to update.
My site received a fake plugin: have my customer data leaked?
The plugin grants full access to the site: everything the site contains could have been read. If customer accounts, orders, or forms are stored, notification to the CNIL must be made within 72 hours if there is a risk to individuals.
Need help?
If you prefer to delegate: I’ll remove the keys, check accounts, plugins, and files, verify your backups, and write up what’s been done. Free diagnosis within 24 hours, quote provided before any action.
Sources: TeamUpdraft’s incident post, updated as of October 22nd, Patchstack’s analysis, analysis by Nethemba, BleepingComputer, October 20, IT-Connect, October 19, CSO Online, October 21, WP Staging guide, UpdraftPlus page and changelog on WordPress.org.
