TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin (more than 4 million active installations on WordPress.org) and the UpdraftCentral, UpdraftVault and UpdraftClone services, said on 19 October 2026 that it found unauthorised access to the teamupdraft.com website over the weekend of 17–18 October. The company believes its customer database was accessed. That database holds names, email addresses, billing addresses and order history; account passwords stored as hashes; two-factor authentication settings; and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.

Card details are not stored (payments go through Stripe and PayPal). TeamUpdraft says the UpdraftPlus plugin and its downloads were not affected, backups sent to customers' own remote storage (such as Google Drive, Dropbox or Amazon S3) were not affected, and self-hosted UpdraftCentral is not affected. The main risk is the cloud UpdraftCentral connection keys, which can send commands to connected WordPress sites. In response the company closed the access route and fixed the underlying weakness, signed out every teamupdraft.com account, disconnected every site from UpdraftVault and issued new credentials, replaced every UpdraftClone client key, rotated keys with payment providers and other connected services, added monitoring, and reported the incident to the UK Information Commissioner's Office and other authorities.

It released UpdraftPlus 1.26.12 (free) and 2.26.12 (Premium) to automatically disconnect old UpdraftCentral connections so the old keys stop working (this card earlier gave the cutoff as 22:00 BST on 18 October, from an earlier version of TeamUpdraft's page; the page now says 1.26.13 and 2.26.13 disconnect every UpdraftCentral connection made before 13:07 BST on 18 October, 8:07 pm Perth); 1.26.12 was published on WordPress.org on 19 October at 16:46 UTC (12:46 am Perth, 20 October) with the changelog entry 'Revokes UpdraftCentral Cloud keys created before the incident'.

TeamUpdraft said on 21 October: 'We know the attacker used a compromised key to access our site', and that 'The attacker exploited the connection to users’ sites to create admin accounts, install malicious plugins etc – the extent of that is unknown'.

It has not said how many accounts are affected. No Australian impact has been reported, but Australian agencies, hosts and businesses that manage WordPress sites through cloud UpdraftCentral are in scope.

UPDATE (21 Oct; Patchstack, Nethemba, TeamUpdraft): the stolen keys were used. Patchstack (Critical, CVSS 9.8; no CVE, as this is a key compromise rather than a code flaw) says an attacker holding valid UpdraftCentral dashboard keys sent correctly signed plugin.upload_plugin commands to connected sites between 18 October 15:32 UTC and 19 October 09:23 UTC (11:32 pm 18 Oct to 5:23 pm 19 Oct Perth), installing at least 99 differently named backdoor plugins (the name 'Site Health Cache' recurs; every sample carries the description 'Small maintenance toolkit: keeps option storage tidy.').

The backdoor creates an Editor-looking account that also holds manage_options and install_plugins and logs the attacker in by cookie, bypassing the login form and 2FA; the account survives removal of the plugin. Early samples crashed sites with HTTP 500 errors; Nethemba documents a working newer variant and says two of its three targeted sites, running WordPress 7.1.3 and UpdraftPlus 2.26.11, were backdoored. Patchstack notes sites can hold a key without anyone choosing UpdraftCentral, because connecting a TeamUpdraft.com account ticks 'Add this website to UpdraftCentral' by default, and keys do not expire.

Published indicators include source addresses 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9, accounts such as data-ops43 and media-staff96 with @example.org emails and display name 'Site Tools', and an option ending in _sync_token. Nethemba found that 1.26.12 / 2.26.12 did not actually remove the old keys because of a bug; UpdraftPlus 1.26.13 (WordPress.org changelog: 'Properly apply the revocation in 1.26.12') and 2.26.13 shipped on 19 October just after 22:00 BST (5:00 am 20 Oct Perth).

TeamUpdraft's 20 October 16:25 BST update says the unauthorised access was resolved and 1.26.13 / 2.26.13 block that route, but still asks users to check their sites. With around 10% of UpdraftPlus sites estimated to hold an UpdraftCentral or Migrator key, roughly 400,000 sites may have been exposed (BleepingComputer).

UPDATE (23 Oct 2026; TeamUpdraft incident page, last updated 23 Oct 05:26 BST): in its 21 October 10:23 BST update (5:23 pm Perth) TeamUpdraft said it had found that the attacker used a compromised key to access its site, that 'The speed of the exploits following the breach combined with the initially faulty backdoor plugins suggest that the hackers used AI to accelerate their attack', that it had brought in an external cyber security firm, and that it had 'contacted the relevant authorities (including the police)'. At 15:35 BST on 21 October (10:35 pm Perth) it asked UpdraftPlus Premium users to check their websites for signs of unusual activity 'even if you’ve never used UpdraftCentral', and took its support form offline because of the PHP vulnerabilities.

At 14:42 BST on 22 October (9:42 pm Perth) it said the support form was back, that 'If a site is listed that you didn’t knowingly connect since the 19th Oct, please check it for signs of compromise', and that it is 'seeing a pattern of unexpected ‘editor’ roles'; it asks users to log in to UpdraftCentral through My Account and check the sites listed there for unexpected users, unrecognised plugins and unknown IP addresses in logs.

Correction (24 Oct 2026): an earlier version quoted TeamUpdraft as saying 'Any site listed before this incident has potentially been exposed to the attacker'; that sentence is no longer on its incident page (last updated 23 Oct 05:26 BST), whose 22 Oct 14:42 BST update now asks users to check any listed site they did not knowingly connect since 19 October. (source: https://teamupdraft.com/blog/security-incident-october-2026/)