TeamUpdraft Confirms Security Breach

TeamUpdraft has now published an official security announcement confirming that its website was accessed without authorisation over the weekend of 17–18 October 2026.

Official announcement:

https://teamupdraft.com/blog/security-incident-october-2026/

According to TeamUpdraft, its customer database is believed to have been accessed, potentially exposing UpdraftCentral connection keys, along with other account information.

This disclosure is particularly significant given the numerous reports here of malicious WordPress plugins being installed through the UpdraftCentral remote management interface on 19 October.

In our own investigation, we confirmed that eight separate WordPress installations running UpdraftPlus 1.26.11 were compromised. The UpdraftCentral logs recorded 12 plugin.upload_plugin commands from the same unauthorised IP address, immediately preceding the installation of malicious plugins.

TeamUpdraft’s recommended actions for UpdraftCentral Cloud users include:

1. Delete existing UpdraftCentral connection keys from each connected WordPress installation.
2. Inspect WordPress administrator accounts for unauthorised users.
3. Inspect installed plugins, including Must-Use plugins, for suspicious additions.
4. Change WordPress administrator passwords.
5. Consider restoring compromised websites from backups taken before 17 October.
6. Reconnect to UpdraftCentral using new connection keys only after securing the installations.

TeamUpdraft has also announced an emergency UpdraftPlus release intended to automatically invalidate UpdraftCentral connections established before 22:00 BST on 18 October.

Important: Simply updating UpdraftPlus to version 1.26.11 does not address potentially compromised connection keys. Site administrators should follow TeamUpdraft’s published security instructions rather than relying on a plugin update alone.

This official disclosure provides a plausible explanation for the attacks reported across multiple WordPress installations, although the precise circumstances surrounding the misuse of individual connection keys have not yet been established.

I encourage everyone using UpdraftCentral Cloud to read TeamUpdraft’s announcement and take the recommended precautions immediately.

Could the TeamUpdraft team please confirm when the emergency release is available and clarify whether any additional actions will be required from administrators who have already disconnected or deactivated UpdraftPlus?