- Jun 10, 2010
- 2,441
- 1,625
This is a PSA for anyone using UpdraftCentral to manage their WordPress websites, the paid version with an account. You MUST change your password asap and reconnect your WP sites. I've already been hearing reports of people's wordpress sites receiving backdoors installed on their site because of stolen keys
https://teamupdraft.com/blog/security-incident-october-2026/
If your site was connected to UpdraftCentral (cloud): This is the real danger. UpdraftCentral is designed to manage sites remotely, so anyone holding a stolen connection key could do what you can do from that dashboard. That includes installing or updating plugins, creating users, editing content, and triggering backups or restores. In practice, an attacker could quietly add a hidden admin account, install a backdoor plugin (often a “must-use” plugin, which doesn’t appear in the normal plugin list), inject spam links or malicious redirects, deface pages, or download your database, including customer or user data if you run a store or membership site. A compromised site can also get flagged by Google or blocklisted by your host. That’s why TeamUpdraft’s checklist focuses on unknown admins and unknown plugins. Removing the key stops new commands, but it won’t undo anything already done. The exposure window started around 17 October, so a backup from before then is your clean fallback.
If you use UpdraftVault: Your site has already been disconnected and the old credentials replaced, so the main immediate effect is that your backups aren’t currently running to Vault until you reconnect. The notice doesn’t say whether stolen Vault keys could have been used to read stored backups before they were rotated. Backups contain your full database and files, so it’s worth asking their support if your site holds sensitive data.
If you use UpdraftClone: The old keys are dead, so the realistic impact is broken clones until you switch to the new keys.
Your account itself: Your name, email and address are likely now in someone else’s hands. Expect convincing phishing emails pretending to be TeamUpdraft. Passwords were hashed, but weak ones can still be cracked over time, so any place you reused that password is at risk.
If you only use the free UpdraftPlus plugin with no account: Your site isn’t affected.
https://teamupdraft.com/blog/security-incident-october-2026/
If your site was connected to UpdraftCentral (cloud): This is the real danger. UpdraftCentral is designed to manage sites remotely, so anyone holding a stolen connection key could do what you can do from that dashboard. That includes installing or updating plugins, creating users, editing content, and triggering backups or restores. In practice, an attacker could quietly add a hidden admin account, install a backdoor plugin (often a “must-use” plugin, which doesn’t appear in the normal plugin list), inject spam links or malicious redirects, deface pages, or download your database, including customer or user data if you run a store or membership site. A compromised site can also get flagged by Google or blocklisted by your host. That’s why TeamUpdraft’s checklist focuses on unknown admins and unknown plugins. Removing the key stops new commands, but it won’t undo anything already done. The exposure window started around 17 October, so a backup from before then is your clean fallback.
If you use UpdraftVault: Your site has already been disconnected and the old credentials replaced, so the main immediate effect is that your backups aren’t currently running to Vault until you reconnect. The notice doesn’t say whether stolen Vault keys could have been used to read stored backups before they were rotated. Backups contain your full database and files, so it’s worth asking their support if your site holds sensitive data.
If you use UpdraftClone: The old keys are dead, so the realistic impact is broken clones until you switch to the new keys.
Your account itself: Your name, email and address are likely now in someone else’s hands. Expect convincing phishing emails pretending to be TeamUpdraft. Passwords were hashed, but weak ones can still be cracked over time, so any place you reused that password is at risk.
If you only use the free UpdraftPlus plugin with no account: Your site isn’t affected.
