How We Caught the UpdraftPlus Backdoor Before the News Broke

At 12:35 a.m. Central on October 19, our uptime monitoring alerted us that one of the WordPress sites we manage had gone down. When we logged in, we found a plugin nobody had installed. We removed it, cleaned up what it had left in the database, and checked the rest of our sites.

That was hours before any public analysis appeared. Only afterward did security researchers publish the cause. Keys stolen from TeamUpdraft, the company behind the UpdraftPlus backup plugin, were being used to push backdoors onto WordPress sites. By then, the only thing left for us to do was rotate our UpdraftPlus and UpdraftVault credentials.

Here is what happened, how we handled it, and what to check if you run UpdraftPlus.

What happened at TeamUpdraft

The UpdraftPlus plugin itself was never hacked. TeamUpdraft’s website was. Over the weekend of October 17–18, an attacker got into teamupdraft.com and, the company believes, its customer database. That database held names, email and billing addresses, order history, hashed passwords, two-factor settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. No card details were stored there.

The UpdraftCentral keys were the dangerous part. UpdraftCentral is a remote management service, and its client is built into every copy of UpdraftPlus, free and Premium. A connected site carries out any command signed with the matching dashboard key, with no one confirming it. With the real keys in hand, the attacker’s commands looked exactly like legitimate ones.

That is why this has no CVE and why being on the latest UpdraftPlus did not protect anyone at first. Patchstack counted 99 different backdoor plugin names, mostly random two- or three-word names. Keys did not expire either: some issued in November 2025 still worked in October 2026.

TeamUpdraft also disconnected every site from UpdraftVault and issued new credentials, so Vault backups stop until you reconnect. Self-hosted UpdraftCentral was not affected, and neither were backups stored in your own Google Drive, Dropbox or S3.

How we found it and what we did

No alert told us about a breach. The first sign was a downtime notification: one of our sites had stopped loading. Nothing had been changed on it, and our team’s background in professional security work meant we treated it as a possible incident from the start, not a routine outage.

1. Found an unfamiliar plugin. It had a random-sounding name and none of us had installed it. We deleted it rather than trying to fix it.
2. Checked the user accounts. We confirmed no unknown administrators had been added.
3. Checked the database. We looked for anything that didn’t belong and removed the suspicious entries we found.
4. Checked our other sites. We cleaned up the other sites that had been hit the same way.
5. Rotated credentials once the cause was public. When the reports named UpdraftPlus, our cleanup was already done. What remained was changing our UpdraftPlus account password and reconnecting UpdraftVault with the new credentials.

We were lucky in one way: the site crashed loudly instead of quietly letting someone in. The next section explains why.

Why the site went down, and why you shouldn’t fix it

The backdoor plugins had a bug. Patchstack found a coding error that made affected sites throw server errors before the backdoor could switch on. TeamUpdraft has said the speed of the attack and the faulty plugins suggest the attacker used AI to rush it out.

When it does work, the backdoor creates a user with the Editor role, then quietly gives that account admin-level powers. It also skips the normal WordPress login, so two-factor authentication and login-attempt limits don’t stop it. Researchers have since found variants that hide from the Plugins screen, and one that hides its admin account from the Users screen.

If you find one of these plugins, delete it. Do not try to fix the error. Patchstack warns that repairing the bug is exactly what turns the backdoor on. A white screen or a 500 error that started on October 18 or 19 is worth investigating before you assume it is a bad update.

What to check if you run UpdraftPlus

Updating UpdraftPlus blocks new attacks, but it does not remove a backdoor that is already installed. Every site that runs UpdraftPlus should get this check, even if it has never used UpdraftCentral.

1. Log in to each site directly. Use the site’s own WordPress dashboard, not UpdraftCentral.
2. Update UpdraftPlus to 1.26.13 or later (Premium: 2.26.13 or later).
3. Delete the UpdraftCentral connection key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. With WP-CLI: wp option get updraft_central_localkeys to check, then wp option delete updraft_central_localkeys to remove it.
4. Check your plugins, including the Must-Use tab. Delete anything you don’t recognize. Don’t repair it.
5. Check your users, especially administrators and editors. Run wp user list --role=administrator --skip-plugins (and again with --role=editor) so a backdoor can’t hide an account from the list.
6. Check the database for users, options or scheduled tasks you didn’t create.
7. Change every administrator password and log out all sessions.
8. Change your teamupdraft.com password and reset its two-factor authentication. Change it anywhere else you reused it.
9. Reconnect UpdraftVault under Settings > UpdraftPlus > Settings with your new password, then run a manual backup to confirm it works.
10. Rotate remote storage keys (Google Drive, Dropbox, S3) if the site was reached through UpdraftCentral.
11. Restore if needed. If you found anything suspicious, consider restoring from a backup taken before October 17.

What we’re taking from this

• Uptime monitoring is a security tool. A downtime alert was our first and only warning, hours before anything was published.
• Remote-management connections are standing access. A connection you set up once and forgot can still take commands years later. Disconnect what you don’t actively use.
• Unknown plugins get deleted, not debugged. A broken plugin nobody installed is a red flag, not a bug to fix.

Sources

• TeamUpdraft: Security incident – what customers need to know
• Patchstack: Stolen UpdraftCentral keys are backdooring WordPress sites
• Nethemba: UpdraftCentral backdoor analysis
• Imunify360: UpdraftCentral key compromise and cleanup
• The Repository: Attacker uses stolen UpdraftCentral keys
• Search Engine Journal: UpdraftPlus security breach enables backdoor attacks