UpdraftPlus hacked: how to check your WordPress site
Stolen UpdraftCentral keys let attackers add hidden admin accounts to WordPress sites. What happened, how to check yours, and what to ask your developer.
You use UpdraftPlus to back up your WordPress site, and now the news says it was “hacked”. Is your site in danger? Do you need to change anything today?
Short answer: UpdraftPlus itself was not broken. Its maker’s own website was. Attackers used what they took from it to get into some customers’ sites. Updating the plugin helps, but it does not remove anything an attacker already left behind. Here is what happened and how to check.
What happened
TeamUpdraft, the company behind UpdraftPlus, said someone got into its website over the weekend of 17 and 18 October 2026. The attacker reached a customer database holding account details and connection keys for UpdraftCentral, a feature that lets one dashboard manage many WordPress sites from afar. TeamUpdraft says payment details were not stored and that the plugin’s files and downloads were not touched.
A connection key works like a spare key to your site. The plugin on your site accepts instructions from anyone holding the matching key. With stolen keys, attackers sent instructions that looked completely genuine, and the sites obeyed.
According to the security firm Patchstack, the first attack it saw was on 18 October. The sites were told to install a fake plugin with a harmless-sounding name such as “Site Health Cache”. Patchstack counted at least 99 different names. The fake plugin then creates a hidden user and gives it the power to install plugins and manage settings, which in practice means full control.
Two things make this nastier than a normal break-in:
- It gets round your login protection. Patchstack reports the backdoor logs in without going through the normal login page, so two-factor authentication and “too many attempts” blockers never see it.
- The hidden user can outlive the fake plugin. Patchstack says the account stays even after the plugin is removed. Deleting the odd plugin is not the end of the job.
Is my site affected?
Not every UpdraftPlus site. TeamUpdraft says the problem affects sites with an active UpdraftCentral connection, and says its self-hosted version is not affected. But you may have a key you never knowingly set up. Search Engine Journal reports that linking a site to a TeamUpdraft account could create the connection automatically, because the remote management option was ticked by default. BleepingComputer estimates about 10 per cent of UpdraftPlus sites carry such a key, which it puts at roughly 400,000 sites. That is their estimate, not a count published by the vendor.
So “I only use it for backups” is not proof you are safe. Check.
What to check, in this order
You need administrator access to WordPress. Set aside 20 minutes.
- Update UpdraftPlus. The fixed versions named by the press are 1.26.13 for the free plugin and 2.26.13 for Premium, or anything newer. Reports differ on the timing: Patchstack’s first post said no fix existed yet, and later reports say updates were released on 19 October. Whatever the date, update, and treat it as the start, not the end.
- Remove the remote management keys. In WordPress, open Settings, then UpdraftPlus Backups, then Advanced Tools, then UpdraftCentral, and delete any keys listed. Backups keep working; only remote management stops. Patchstack stresses that taking the site off the dashboard is not enough, the keys on the site itself must go, because the attacker may already hold copies.
- Look at your users. Open Users and sort by role. Any administrator or editor you did not create is a red flag. Patchstack lists two account names seen in the attacks,
data-ops43andmedia-staff96, plus a display name of “Site Tools” and email addresses ending in@example.org. Other attackers will pick other names, so judge every unknown account, not only those. - Look at your plugins. Open Plugins and read the whole list. Anything you did not install, especially a “maintenance” or “health” style tool, needs explaining. Do not click Activate on something suspicious, and do not try to repair a plugin that is showing errors. Patchstack warns that fixing it can switch the backdoor on.
- Look at registration settings. Open Settings, then General. If “Anyone can register” is ticked and the default role is Administrator, switch that off and ask why it was on.
If you find something
Take this one seriously, because the attacker had real control.
- Do not just delete the plugin and carry on. The hidden user can stay behind.
- Write down what you saw before changing anything: names, dates, screenshots.
- Change passwords and end sessions. That means every administrator, your TeamUpdraft account, and your hosting login. Turn on two-factor authentication for each.
- Plan to restore. Patchstack’s advice for a confirmed backdoor is to restore from a backup made before the attack and compare the files against a clean copy of WordPress. A backup from before 17 October is the safe choice. Your UpdraftPlus backups are your friend here, as long as they are older than the attack.
- Think about your visitors. If you run a shop, a membership or a booking form, ask whether customer details could have been reached, and get advice on what the law in your country requires you to report. We are not lawyers and will not guess.
What to ask your developer or host
If someone else looks after your site, send these today:
- Does our site carry any UpdraftCentral keys, and have they been deleted?
- Which UpdraftPlus version are we on, and when did we update?
- Has anyone checked our users and plugins for anything we did not create?
- Do our server logs go back to 17 October, and has anyone read them?
- If we are clean, how do you know? What did you look at?
“Looks fine” is not an answer. A good one names what was checked and when.
What a scanner can and cannot tell you
We built a free website checker, and it is honest about its limits. It looks at what your site shows the outside world: whether your WordPress version is on display, whether login names can be listed, whether the old XML-RPC side door is open, and your security headers. It cannot see your list of users or plugins from the outside, so it cannot tell you whether this backdoor is on your site. For that, someone has to look inside WordPress. The free check is still a useful way to spot the easy gaps attackers try first.
Want us to check yours?
- Free: run the website security checker for the outside view of your site.
- Done for you: our website security service looks inside your WordPress for accounts and plugins that should not be there, helps clean up and recover, and tidies the settings that let this happen.
Then reach us:
- Email hello@wpfoss.com
- WhatsApp +254 118 271 160
- Tell us what you need
If you already see an account or plugin you do not recognise, say so in the first line and we will look at it first. For the wider picture of this month’s attacks, read our Black October explainer.