On October 18, 2026, attackers breached UpdraftCentral Cloud, the remote management service built into UpdraftPlus (one of the most popular WordPress backup plugins, with over 4 million active installations). They stole the private signing keys UpdraftCentral uses to send commands to connected WordPress sites.
Those keys let the attacker send commands that look completely legitimate. Your site can't tell the difference between a real UpdraftCentral command and the attacker's. This is not a plugin vulnerability. Updating UpdraftPlus will not stop it.
As of October 19, over 100 sites have been compromised, and the attacks are ongoing.
Here's what you need to know and what to do.
What Happened
UpdraftCentral is a remote site management service from TeamUpdraft, the company behind UpdraftPlus. Its client ships inside every copy of UpdraftPlus, free and premium. When a site is connected to UpdraftCentral, it generates an RSA key pair and stores the dashboard's public key. From that point on, the site executes any command signed with the dashboard's private key, with the permissions of the administrator who created the connection.
The attacker breached the UpdraftCentral Cloud environment and obtained those dashboard private keys. With them, the attacker can install and activate any plugin on any connected site, without the site owner knowing. TeamUpdraft confirmed the breach via email to their customers on October 18, stating they "detected unauthorized access to the teamupdraft.com website" and that "UpdraftCentral connection keys were also compromised."
The commands are properly encrypted and signed with genuine keys. Every security check in the plugin passes because, from the site's perspective, the instruction is legitimate.
Who Is Affected
Every WordPress site running UpdraftPlus (free or premium) that has an active UpdraftCentral key is at risk.
Here's the part that catches people off guard: you may have an active key even if you never intentionally used UpdraftCentral. When you connect your TeamUpdraft account in the UpdraftPlus settings, there's a checkbox that reads "Add this website to UpdraftCentral (remote, centralized control)." It's checked by default. Leave it ticked (which many site owners do without noticing), and your site gets an UpdraftCentral key with full admin permissions.
Patchstack's security team confirmed they're seeing sites with active UpdraftCentral keys whose owners only ever used UpdraftPlus for backups.
Sites without an UpdraftCentral key are not affected. The UpdraftCentral client is dormant without a key.
What the Attacker Is Doing
The attacker is sending plugin.upload_plugin commands through the UpdraftCentral channel to install backdoor plugins on connected sites. The attack follows a consistent pattern:
- Probe. The attacker sends a message to a non-existent key (
probe.central.updraftplus.com). The site responds that it doesn't understand, which confirms it accepts UpdraftCentral commands.
- Install. A few hours later, the attacker sends the real command with the site's actual key. WordPress installs and activates the malicious plugin through its standard installer.
The whole thing happens silently. No notification, no confirmation prompt, no log entry your average site owner would ever check.
What the Backdoor Plugin Does
Every backdoor plugin is generated from the same template but with randomized names, tokens, and credentials. Here's what it's designed to do:
Create a hidden admin account. The plugin hooks into every WordPress request and watches for a secret URL parameter. When triggered, it creates a user account with:
- The Editor role (so it doesn't show up when you review your administrator list)
- Two extra capabilities:
manage_options and install_plugins (giving it full admin control despite looking like an Editor)
- An email address at
@example.org
- The display name "Site Tools"
- A username in the format "word-word" plus two digits (confirmed examples:
data-ops43 and media-staff96)
Bypass all login protections. The plugin logs the attacker in by setting an authentication cookie directly. This skips the WordPress login form entirely, so two-factor authentication, login attempt limits, and any login-protection plugins never run.
Persists after removal. Even if you delete the plugin, the user account stays in WordPress with its known password. The attacker can log back in through the normal login form.
The good news: the current batch of backdoor plugins contains a coding bug that crashes the site with a PHP error before the backdoor can activate. That's actually how the first victims discovered it (their sites went down). But the attacker only needs to fix a few characters for the next wave to work silently. Do not assume the bug will protect you.
How to Check if Your Site Is Affected
Check for UpdraftCentral Keys
In your WordPress admin, go to Settings, then UpdraftPlus Backups, then Advanced Tools, then UpdraftCentral. If you see any keys listed under "Manage existing keys," your site is connected and was exposed.
Check for the Backdoor Plugin
Look through your plugin list for anything with the description:
Small maintenance toolkit: keeps option storage tidy.
The plugin names are randomized (examples include "Site Health Cache," "Load Stack 35C," "Fast Engine," "Seo Helper," and dozens more), so don't search by name. Match on the description.
If your site returns a 500 error on every page and you can't access the admin, the backdoor is crashing the site. You'll need command line or SFTP access to remove it.
Check for Suspicious User Accounts
Go to Users in your WordPress admin and look for:
- Any account with the display name "Site Tools"
- Any account with an
@example.org email address
- Any Editor account you don't recognize, especially with a username like "word-word" followed by two digits
If you find an account matching these markers, the backdoor was activated on your site. Change all administrator passwords immediately, remove the account, and contact your hosting provider.
What to Do Right Now
1. Delete Your UpdraftCentral Keys
Go to Settings, then UpdraftPlus Backups, then Advanced Tools, then UpdraftCentral, then "Manage existing keys" and delete every key.
If you have WP-CLI access:
wp option delete updraft_central_localkeys
Your backups will keep working. Deleting the keys only stops remote management through UpdraftCentral. Scheduled backups, manual backups, and restores are all unaffected.
2. Remove Any Backdoor Plugins
If you find a plugin matching the description above, deactivate it and delete the plugin folder via SFTP or your file manager. Don't uninstall through the WordPress admin, as the plugin's uninstall routine deletes its own traces.
3. Remove Any Backdoor User Accounts
Delete any accounts matching the markers described above. Then change all administrator passwords and end all active sessions (Users, then Your Profile, then Log Out Everywhere Else).
4. Do Not Reconnect to UpdraftCentral
Until TeamUpdraft fully explains how the keys leaked and confirms the breach is resolved, reconnecting would only generate a new key that could end up with the attacker the same way.
5. If the Backdoor Account Exists, Treat the Site as Fully Compromised
The attacker had admin-level access. They could have uploaded additional plugins, modified files, or changed database entries. Restore from a backup taken before October 18, compare your files against a clean WordPress installation, and review every user account on the site.
What Levamo Is Doing for Customers
As a precaution, we've started deactivating all stored UpdraftCentral keys across customer sites. Your backups will keep working normally.
Advanced SiteShield, powered by Patchstack, is also actively blocking all UpdraftCentral remote commands on protected sites as an additional safeguard. If your UpdraftCentral dashboard shows sites as unreachable, that's this block in action.
Our support team is available 24/7 if you need help checking your site or cleaning up after this. Just open a chat in your Levamo dashboard or reply to the security alert email we sent earlier today.
Why Updating UpdraftPlus Doesn't Fix This
This is worth repeating because it's the most counterintuitive part.
Normally, when a WordPress plugin has a security issue, the fix is to update the plugin. That works when the vulnerability is in the plugin's code. This is different. The plugin code is working exactly as designed. The problem is that the attacker has the keys the system was designed to trust.
Think of it like this: if someone copies your house key, changing the lock manufacturer doesn't help. You need to change the lock. In this case, deleting the UpdraftCentral key is changing the lock.
There was a code vulnerability in this same UpdraftCentral channel back in June 2026 (CVE-2026-10795) that let an attacker forge commands without valid keys. That was patched in UpdraftPlus 1.26.5 / 2.26.5. But this new attack doesn't use that vulnerability. The attacker has real keys.
Broader Context: What This Means for Remote Management
This incident highlights a risk that applies beyond UpdraftPlus. Any remote management service that holds master keys to customer sites creates a single point of failure. If that service is breached, it exposes every connected site at once.
It's the same principle behind supply chain attacks: you trust a vendor, the vendor gets compromised, and that trust becomes the attack vector.
For site owners, the takeaway is practical:
- Audit which services have remote access to your WordPress site
- If you don't actively use a remote management connection, remove it
- When you do use one, create the connection under an account with only the permissions you actually need (on one of the publicly analyzed sites, the attack failed because the key belonged to a user without plugin installation rights)
Wrapping Up
The UpdraftCentral breach is serious, but the fix is straightforward: delete your UpdraftCentral keys, check for suspicious plugins and user accounts, and don't reconnect until TeamUpdraft confirms the breach is resolved. Your backups aren't going anywhere.
If you're on Levamo, we're already handling key deactivation across customer sites, and our support team is standing by 24/7 to help you check. If you're not, the steps above work on any WordPress host.
