UpdraftPlus Hacked: Act If You Have an UpdraftCentral Key

Not every WordPress site running UpdraftPlus was exposed to this attack. The sites running UpdraftPlus Free or Premium with a cloud UpdraftCentral connection key are the ones that could receive the attackers' commands. TeamUpdraft says free users without a teamupdraft.com account do not need to take any action.

If you do have a key, the check takes about ten minutes and needs only your own WordPress login. Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and look at "Manage existing keys." If a key is listed, delete it, update to Free 1.26.12 or Premium 2.26.12, and then look at your plugins and users.

TeamUpdraft, Wordfence and Nethemba all published their findings on October 19, 2026. You do not need to uninstall UpdraftPlus or replace your website because of this news, but if a key was there, the update alone does not finish the job.

Find out in ten minutes whether your site is in scope

Start from your own site, not from the UpdraftCentral dashboard. Use the normal WordPress login you always use, because the point is to see what the site itself holds. Wordfence's public service announcement gives the same check path as TeamUpdraft.

1. Log in directly: Open your own wp-admin address, not a link from an email or a remote dashboard.
2. Open the key list: Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and find "Manage existing keys."
3. Read the count: A number above zero means a cloud connection key exists on this site.
4. Note your version: Free should be 1.26.12 and Premium should be 2.26.12.
5. Scan the plugin list: Look for anything you did not install, including Must-Use plugins where your host shows them.

Why would a key exist if you never meant to create one? Wordfence notes that UpdraftPlus 1.26.11 offers to add the site to UpdraftCentral when you connect a TeamUpdraft account, and that option is selected by default. It is easy to click through that step and forget it.

Get the dates straight so you know which of your sites to check first

The facts are short and the times matter. TeamUpdraft disclosed unauthorized access to teamupdraft.com over the weekend of October 17 to 18, 2026, and says its customer database included UpdraftCentral, UpdraftVault and UpdraftClone connection keys. Attackers then used valid UpdraftCentral keys to send commands to connected WordPress sites.

Wordfence saw the malicious uploads on Premium 2.26.11 and on Free 1.26.10 and 1.26.11. Nethemba's technical analysis documents the commands and the plugins they installed. Check the version on every site you look after, not only the main one.

This is a different event from CVE-2026-10795 in June 2026, which involved forged commands on older versions. This incident is about stolen connection keys, so do not treat a June patch as proof that you are clear of this one.

Close the door in the right order

TeamUpdraft and Wordfence list slightly different orders, and both end in the same place. Work from this sequence, which keeps the key deletion and the evidence at the front.

1. Log in directly to the site, as in the check above.
2. Delete every key under "Manage existing keys." Wordfence puts this first.
3. Change your teamupdraft.com password from a device you trust, and reset two-factor authentication on that account if you have one.
4. Save the logs before you clean anything. Copy the UpdraftCentral log events and note any suspicious file names.
5. Update to Free 1.26.12 or Premium 2.26.12.
6. Inspect users and plugins, and scan the site.
7. Restore if something looks wrong, using the recovery steps in the sections below.
8. Change administrator passwords and end active sessions.
9. Reconnect last, with a new key, and only if you still use UpdraftCentral.

The update matters, but it is one step, not the whole fix. It disconnects connections made before 22:00 BST on October 18. It does not remove a plugin that was already installed, and it does not prove the site is clean.

Keep your backups usable

Start with where your backups live. TeamUpdraft says the UpdraftPlus plugin itself and its downloads were not affected, that backups stored in your own Google Drive, Dropbox or Amazon S3 were not affected, and that self-hosted UpdraftCentral was not part of this incident.

As a precaution, TeamUpdraft recommends reauthorizing your storage and changing storage keys for any site that was accessed through UpdraftCentral. Do that after the site is clean, so a fresh credential does not land on a compromised site.

Two product notes from the advisory. If you use UpdraftVault, reconnect it with the new credentials and run a manual backup to confirm it works. If you use UpdraftClone, replace the old client keys with new ones.

Spot a compromise even when the user list looks normal

Four things are worth acting on. In the UpdraftCentral log, look for events that read "Command received: plugin.upload_plugin" and for references to probe.central.updraftplus.com. TeamUpdraft documents how to view the event log. Then check plugins, including Must-Use plugins, and administrator accounts.

Do not stop at the user list. Nethemba documents a variant that logged the attacker in as an existing administrator without creating a new user. A list that looks unchanged does not settle the question, so read the log and the plugin folder too. If you need a refresher on reviewing accounts, our post on adding or removing an admin user in WordPress walks through the screen.

Recover without bringing the attacker back

If anything suspicious turns up, stop treating this as an ordinary plugin update. Save the logs and the suspicious files first, because deleting them erases the evidence of how far this went. Disconnect UpdraftCentral and take the site offline if you need to.

A restore point is a backup made before October 17, 2026, and only one whose integrity you can reasonably establish. After the restore, reinstall WordPress core, every plugin and the theme from trusted sources. Deleting the one visible bad plugin and moving on leaves the door open.

Then rotate the credentials: administrator passwords, hosting, database, storage and API credentials, and the WordPress salts. WordPress.org's hacked-site guidance puts documentation ahead of cleanup, which is why the logs come first. Its hardening page frames part of the job as "containing the damage done if there is a successful attack."

Know when to hand it to a professional

Handing it off is the right call in a few situations: you found anything suspicious, you cannot check files and the database outside WordPress, or the site holds customer data, takes payments, runs custom code or is one of several you manage. It also applies if the logs suggest an attacker logged in as an existing administrator.

The work worth paying for is evidence collection, a judgment on what to restore, and credential rotation done across hosting, database and storage together. It is not a reason to assume every UpdraftPlus site was hacked. Our guide to what malware removal costs explains how that work is priced, and the first 24 hours after a hack covers the general emergency steps.

Cut the connections you do not use, on any plugin

This is no sign that other vendors were breached. The lesson is narrower and practical: any plugin that accepts commands through a vendor account is a door your site opens to that account. Remote-management dashboards, backup connectors and site-management tools all work this way.

Set aside twenty minutes and audit them:

• List the plugins that connect to an outside dashboard.
• Name the vendor account each one connects to.
• Open that dashboard and review the sites and keys it holds.
• Remove what you no longer use in the dashboard and in the plugin settings.
• Confirm the local key is gone, because removing a site in the vendor dashboard may not delete the credential on the site.

TeamUpdraft's own guide shows how a site is added to UpdraftCentral, which tells you what to look for when you remove one. Pair this with a habit of checking your WordPress plugins for urgent security updates, and keep the list in your site's maintenance routine.

A site with no plugins to patch is another option. A static Next.js site, like the ones we build as part of web design, has no plugin command listener, so this specific exposure does not apply to it. Its hosting, deployment and CI credentials remain separate risks and need their own care.

Frequently Asked Questions About the UpdraftPlus Hack

Was every UpdraftPlus site affected?

No. The incident concerned sites with a cloud UpdraftCentral connection key. TeamUpdraft says free users without a teamupdraft.com account do not need to take any action.

Where do I check for a connection key?

Log in to your own WordPress dashboard and open Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. Read "Manage existing keys."

Are my Google Drive, Dropbox or S3 backups safe?

TeamUpdraft says backups in your own storage were not affected. It still recommends reauthorizing storage and changing storage keys for any site accessed through UpdraftCentral.

Is updating to 1.26.12 or 2.26.12 enough?

No. The update disconnects older connections but does not remove anything already installed. Check your plugins, users and logs as well.

Should I delete UpdraftPlus?

No. Delete the connection keys, update the plugin, and remove only what you no longer use.

What if I find a plugin I did not install?

Save the logs and the suspicious files, treat the site as compromised, restore from a backup made before October 17, 2026 if you can trust it, and bring in a professional.

Wrapping Up

If your site has a cloud UpdraftCentral connection key, the work is to log in directly, delete the key, update, check plugins and users, and restore only from a backup made before October 17, 2026. If it has no key, Wordfence notes that UpdraftPlus does not accept UpdraftCentral commands at all. Either way, TeamUpdraft says UpdraftPlus itself and backups in your own storage were not affected.

Taking ten minutes now means one fewer unknown credential and one fewer forgotten connection on every site you look after. Do the same audit for any plugin tied to a vendor account, and you will know exactly who can send commands to your site.

If the check turns up something you cannot explain, Web Leveling can look at it with you, from the logs to the credentials, through our website security audit. We work with small and medium businesses across the country and overseas. Send us what you found on your site, and we can work out together what to restore and what to rotate.

Terms