Keys stolen in the TeamUpdraft breach were used to plant backdoors on WordPress sites

A customer database was reached, and the keys opened sites

In an incident post published on October 19, 2026, TeamUpdraft said it had detected unauthorised access to teamupdraft.com. According to the company, the customer database that was reached held names, email addresses, billing addresses, order history, hashed passwords, two-factor authentication settings and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Card details are not stored; Stripe and PayPal process payments. TeamUpdraft also says the UpdraftPlus plugin files and downloads, the backups sitting in users' own remote storage and self-hosted UpdraftCentral were not affected.

Patchstack's records show the attack began at 15:32 UTC on October 18, when the attacker used valid UpdraftCentral keys to install backdoor plugins on connected WordPress sites. TeamUpdraft also writes that the attacker used a compromised key to get into teamupdraft.com, then exploited its links to customer sites to set up admin accounts and install malicious plugins, adding that the full extent is not known. Describing its own response, the company said, in the words BleepingComputer quotes: "Our team responded straight away and worked through the night to contain it".

How the backdoor works and which release fixes it

Patchstack says the campaign ran in an 18-hour window across October 18-19, from the first install at 15:32 UTC on October 18 to the last record at 09:23 UTC on October 19. It logged at least 99 different backdoor plugin names and two attacker IP addresses, one IPv4 and one IPv6. The backdoor plugin is triggered by a hidden URL parameter and creates an account with the Editor role, then adds the manage_options and install_plugins capabilities to it. Because the account signs in with a cookie, it skips the login form, two-factor authentication and login protection plugins, and it stays even if the plugin is deleted. Patchstack says the name "Site Health Cache", used again and again, is its strongest name-based indicator, but since most other names are random, the most reliable file-level sign is the description shared by every sample: "Small maintenance toolkit: keeps option storage tidy."

For the fix, TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) after 22:00 BST on October 19; they revoke UpdraftCentral keys. BleepingComputer reports that Nethemba said the earlier 1.26.12/2.26.12 release was supposed to delete the keys but failed because of a bug. Per Patchstack, keys do not expire: keys generated in November 2025 were still working in October 2026. It also points out that a box ticked by default on the teamupdraft.com account screen, "Add this website to UpdraftCentral", can create keys that site owners never intended. Patchstack stresses this is a key compromise with no CVE assigned.

The update removes the keys, not the backdoor

Patchstack is explicit that this is a key compromise, not a security flaw in UpdraftPlus code, which is why keeping the plugin up to date is not enough on its own. Versions 1.26.13 and 2.26.13 cut off new attacks at the connection point, but they do not remove a backdoor plugin or admin accounts that were already created. Patchstack recommends deleting the keys, either in wp-admin or with wp option delete updraft_central_localkeys; taking the site off the UpdraftCentral dashboard alone does not help, because the key that matters sits on the site itself. BleepingComputer suggests deleting keys on every site under UpdraftPlus Backups > Advanced Tools > UpdraftCentral > Manage existing keys. TeamUpdraft's October 22 update, timestamped 14:42 BST, advises looking for unexpected "editor" roles, unrecognised plugins and IP addresses you do not recognise in logs.

If compromise is confirmed, BleepingComputer recommends restoring from a clean backup, changing the TeamUpdraft account password, revoking sessions and resetting the two-factor authentication method. Be careful with scale: Patchstack reports more than 4 million active UpdraftPlus installations, while the 5 million plus figure on the TeamUpdraft page covers sites running any of the company's plugins, not UpdraftPlus alone. BleepingComputer writes that an estimated 10 percent of sites using the plugin may hold an UpdraftCentral or Migrator key, which would mean around 400,000 sites. That is an exposure estimate, not a verified count of backdoored sites. TeamUpdraft also says the speed of the attack suggests AI was used, which is the company's own view. For a comparable WordPress supply chain story, see our Rank Math PRO backdoor article.

The sources say nothing about Türkiye, so this section is commentary

None of the three sources mentions Türkiye: there is no count of affected sites in the country and no statement from a local institution or regulator. The reporting is a general account aimed at plugin users everywhere. This section is therefore not a fact drawn from the sources but explicitly UNALSOFT commentary.

Our reading is that UpdraftPlus is a widely used backup plugin, so it is reasonable to expect it on many Turkish sites too, but there is no figure for that. The practical work falls to the site owner and the agency running the site: check whether the site uses UpdraftPlus, whether an UpdraftCentral key exists, and scan for unauthorised admin accounts and plugins. The number of affected sites in Türkiye and any response from local bodies cannot be known from these sources.

Sources

TeamUpdraft, security incident: what customers need to know · BleepingComputer, stolen UpdraftCentral keys used to backdoor WordPress sites · Patchstack, UpdraftCentral key compromise and WordPress backdoors