If your site runs UpdraftPlus and was ever connected to a TeamUpdraft account, you need to check it today. Over the weekend of October 17–18, 2026, an attacker got into teamupdraft.com and, according to the vendor, probably took the customer database, including UpdraftCentral connection keys. Starting October 18 those keys were used to send validly signed commands to connected sites, installing backdoor plugins that log the attacker into wp-admin.
This isn’t a classic plugin bug. Patchstack points out that the commands pass every check because they’re signed with real keys. You fix it by deleting the keys. Updating alone isn’t enough, and that’s the part a lot of people are missing right now. Here’s how I check and clean a site, mostly with WP-CLI.
Back up files and database before you change anything. If the site turns out to be compromised, keep that backup as evidence and don’t restore from it.
Who is affected
- Sites with an active UpdraftCentral Cloud connection, on both free and Premium UpdraftPlus.
- Sites you never meant to connect. When you linked a site to a TeamUpdraft account, the “Add this website to UpdraftCentral” checkbox was ticked by default, so a backup-only site can still have a remote-management key. Patchstack also notes that these keys never expire.
- Not affected, according to TeamUpdraft: self-hosted UpdraftCentral, the UpdraftPlus plugin downloads, and backups stored in your own remote storage.
Step 1: Update UpdraftPlus to 1.26.13 / 2.26.13 or later
TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) on October 19, and WordPress.org pushed the update automatically. Don’t stop at 1.26.12: Nethemba found that the .12 releases deleted no keys at all. Check what you have:
wp plugin list --skip-plugins --skip-themes | grep -i updraft
wp plugin update updraftplus --skip-plugins --skip-themesI use --skip-plugins on every command here. If a backdoor plugin is active, it can crash WP-CLI before your command even runs.
Step 2: Delete leftover UpdraftCentral keys by hand
This is the gap. The update revokes keys created before 13:07 BST (12:07 UTC) on October 18. Nethemba reports that keys created between 12:07 and 21:00 UTC that day stay on the site. The keys live in the updraft_central_localkeys option. To list them with their creation times (read-only):
wp eval 'foreach ( (array) get_option("updraft_central_localkeys") as $id => $k ) echo $id, " ", gmdate("Y-m-d H:i", $k["created"] ?? 0), " UTCn";' --skip-plugins --skip-themesAny output means the site still accepts remote commands. Unless you deliberately use UpdraftCentral and recreated the key after cleanup, delete it. Patchstack says to do this before removing any backdoor, or the attacker can just push a new one:
wp option delete updraft_central_localkeys --skip-plugins --skip-themesYou can do the same in wp-admin under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral. Removing the site from the teamupdraft.com dashboard does not remove the key stored on the site. Backups keep working without the key. Nethemba also suggests clearing updraft_migrator_localkeys if you don’t actively use the Migrator add-on, because it uses the same channel.
Step 3: Look for the backdoor plugins on disk
Patchstack counted at least 99 plugin names, usually random two- or three-word combinations such as “Site Health Cache”, “Speed Kit”, “Lazy Boost” or “Content Helper”. Matching on names is unreliable, so search the files instead. One variant also hides itself from the Plugins screen, which is why I check the disk:
cd /path/to/wordpress
grep -rl "keeps option storage tidy" wp-content/plugins wp-content/mu-plugins wp-content/upgrade
grep -rl "keep service accounts out of the main user list" wp-content/plugins wp-content/mu-plugins wp-content/upgrade
ls -lt wp-content/plugins | head -20The last command sorts plugin folders by modification time. Anything dated October 18 or later that you didn’t install deserves a close look. Nethemba reports folder names like load-stack-35c (a word-word-3hex pattern), plus boost-kit, src-lab and site-health-364f.
If your site has been throwing HTTP 500 errors on uncached pages since October 18, the early backdoor variant may be the cause. It has a coding bug that triggers a fatal error on PHP 8. Do not “fix” that plugin. Fixing it activates the backdoor.
To remove a backdoor, don’t use the Delete button in wp-admin. One variant ships an uninstall.php that wipes its traces. Move it out of the web root instead:
mkdir -p ~/quarantine
mv wp-content/plugins/load-stack-35c ~/quarantine/Step 4: Find the backdoor accounts and options
The backdoor creates an Editor account and then grants it manage_options and install_plugins, so a quick look at the Administrators list misses it. Known logins include data-ops43 and media-staff96, with the display name “Site Tools” and an @example.org email. A second variant creates full administrators with @example.com emails. Adjust the wp_ prefix and run:
-- Editors that secretly have admin capabilities
SELECT u.ID, u.user_login, u.user_email, u.user_registered
FROM wp_users u
JOIN wp_usermeta m ON m.user_id = u.ID AND m.meta_key = 'wp_capabilities'
WHERE m.meta_value LIKE '%manage_options%' AND m.meta_value LIKE '%editor%';
-- Known email patterns
SELECT ID, user_login, user_email, display_name, user_registered FROM wp_users
WHERE user_email LIKE '%@example.org' OR user_email LIKE '%@example.com';
-- Options left behind by the plugins
SELECT option_name FROM wp_options
WHERE option_name LIKE '%_sync_token' OR option_name LIKE '%_uid' OR option_name LIKE '%_installed';The last query also returns legitimate options, so only delete the ones whose prefix matches a quarantined plugin slug, such as load_stack_35c_sync_token or src_lab_uid. Also review every administrator registered since October 17. Then remove the account, reassign its content, and log everyone out by rotating the salts:
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --skip-plugins --skip-themes
wp user delete data-ops43 --reassign=1 --skip-plugins --skip-themes
wp option delete load_stack_35c_sync_token --skip-plugins --skip-themes
wp config shuffle-saltsRotating salts matters here because the backdoor logs in with a persistent “remember me” cookie, and that cookie bypasses 2FA and login limiters.
Step 5: Check the access logs
Finding the plugin tells you it was installed. The logs tell you whether someone actually used it. Nethemba’s patterns, with the path adjusted for your server:
grep 'class-udrpc.php"' /var/log/apache2/*access*
zgrep -E '[?&](_[0-9a-f]{6}|[0-9a-f]{12})=[^&" ]{32}[& ]' /var/log/apache2/*access*On a hit, a 302 response suggests a successful login. Patchstack also lists attacker IPs 43.250.53.42 and 2a09:bac5:4e21:2e3c::49b:9, but the infrastructure was rotated, so don’t rely on IP blocking. If you see the trigger, a backdoor account, or the _sync_token option, treat the site as fully compromised. Restore from a backup taken before October 17 and compare core files against a clean install. My complete hacked-site cleanup guide walks through that.
Doing this in OpenPanel vs cPanel
Every command above is plain WP-CLI. In cPanel you’d run it over SSH or in the Terminal app, if your host enables it. In OpenPanel, WP-CLI comes preinstalled in each PHP container. On Enterprise you can use Containers → Terminal. On any plan with cron jobs, create a job under Cron Jobs → Create New and click Run to see the output right away. Add --path=/var/www/html/example.com --allow-root, for example wp option get updraft_central_localkeys --path=/var/www/html/example.com --allow-root --skip-plugins. The details are in the OpenPanel WP-CLI docs.
Why this works, and how to prevent the next one
UpdraftCentral trusts any command signed with a key stored on your site. The attacker never needed your password. They needed the dashboard side of that key pair, and it leaked. Deleting updraft_central_localkeys breaks that trust, which is why it’s the actual fix and the update is only part of it. As of 2026-10-24, TeamUpdraft’s incident page is still being updated, so check it for changes.
- Don’t reconnect UpdraftCentral until you’ve cleaned the site and the vendor has explained the cause. If you need remote management, Patchstack suggests creating the key under an account that lacks
install_plugins. - Change all administrator passwords and your teamupdraft.com password, and reset 2FA there. If a site was accessed through UpdraftCentral, re-authorize your remote storage and rotate the storage access keys.
- UpdraftVault sites were disconnected and need to be reconnected under Settings → UpdraftPlus → Settings. Check that your scheduled Updraft backups are still running.
- Audit every site for remote-management keys you forgot about. A key that never expires is a long-term liability. See also how to tell if your WordPress site is hacked.
TL;DR
Stolen UpdraftCentral keys are being used to install backdoor plugins on WordPress sites. Update UpdraftPlus to 1.26.13 / 2.26.13 or later, then run wp option delete updraft_central_localkeys, because some keys survive the update. Grep wp-content for “keeps option storage tidy”, look for Editors that have manage_options, quarantine the plugin instead of deleting it, shuffle salts, and restore from a pre-October 17 backup if the logs show the backdoor was used.
