UpdraftCentral Security Incident: Check Your WordPress Site for Hidden Backdoors

UpdraftCentral security incident: If your WordPress site was ever connected to UpdraftCentral Cloud, check it even if the connection has been removed. TeamUpdraft revoked old connection keys with UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium), but an attacker could have installed a plugin before the disconnection. The vendor’s October 29 update says a small number of sites later developed new administrator accounts from plugins left behind.

This guide separates the connection risk from the cleanup work. It is based on TeamUpdraft’s updated incident notice and Patchstack’s technical analysis. The indicators below are leads to investigate, not proof that every UpdraftPlus site was hacked.

Who needs to check?

Prioritize every site that has ever been connected to UpdraftCentral Cloud, whether the connection was deliberate or created while linking a TeamUpdraft account. Both free and Premium sites can have such a connection. The vendor says self-hosted UpdraftCentral was not affected; free UpdraftPlus users without a teamupdraft.com account do not need incident-specific action. Simply having the backup plugin installed does not prove that your site was compromised.

What changed after the incident?

TeamUpdraft reported unauthorized access to teamupdraft.com during October 17–18, 2026. The company released UpdraftPlus 1.26.13 and 2.26.13 on October 19 and revoked affected UpdraftCentral keys. Its October 29 update warns that disconnecting a site closes that access path but does not remove malicious plugins or users already placed on the site. That distinction is the reason for the checks below.

1. Confirm the version and connection keys

1. Open the affected site’s own WordPress dashboard. Check Plugins for the UpdraftPlus version and update to 1.26.13 / 2.26.13 or later if necessary.
2. Go to Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral. Open “Manage existing keys” and inspect any connections.
3. Delete old connection keys you do not need. The vendor recommends checking that none remain even after the automatic revocation. Removing a site from a remote dashboard alone does not inspect or clean the local site.

With WP-CLI, wp option get updraft_central_localkeys can help check whether a key is stored. Record the result before changing anything. If keys remain, follow the vendor’s dashboard instructions or use wp option delete updraft_central_localkeys once you understand that this disconnects remote management. Scheduled backups to your own storage are separate; verify your actual backup destination after changes.

2. Inspect plugin files, including plugins hidden from wp-admin

Review the Plugins screen and its Must-Use section, then compare it with the actual wp-content/plugins/ and wp-content/mu-plugins/ folders over SFTP, SSH, or the host’s file manager. The malicious plugin may hide itself from the dashboard. TeamUpdraft lists names such as “Site Health Cache”, “Asset Forge 2”, “Core Smith”, and “Seo Helper” as examples, but names vary and legitimate plugins may have similar names. Inspect code and provenance before removing anything.

Patchstack found the description Small maintenance toolkit: keeps option storage tidy. in campaign samples. Search for that phrase in plugin files, but a negative match does not clear the site. Look at creation dates alongside backups and access logs; timestamps alone are weak evidence. Preserve suspicious files outside the web root before cleanup. TeamUpdraft cautions against deleting a suspect plugin from the dashboard because its uninstall routine may erase evidence.

3. Check administrators and editors independently

Audit both administrator and editor accounts, including accounts with extra capabilities. The reported backdoor could give an account labelled “Editor” powerful permissions, so an administrator-only filter misses it. A malicious plugin can also hide users from the normal Users screen.

If WP-CLI is available, compare the dashboard with wp user list --role=administrator --skip-plugins and wp user list --role=editor --skip-plugins. Review unexpected accounts in the database as well, using your actual table prefix. Investigate unknown names and registration dates; do not delete a legitimate staff account based on its name alone. My hidden WordPress admin guide explains why the interface and database can disagree.

4. If you find a backdoor, clean the whole compromise

Take a forensic copy of files, database, and relevant logs. Revoke connection keys, isolate the suspicious plugin outside the web root, and compare all plugin and core files with trusted releases. Investigate users, capabilities, options including an unexplained _sync_token, scheduled tasks, and other persistence. Remove confirmed malicious components, then rotate WordPress and TeamUpdraft credentials, refresh salts to end sessions, and review any storage credentials exposed through the connection. A pre-October-17 clean backup can help, but restoring alone does not replace key revocation or account review.

If your scanner reports clean while the site still behaves strangely, follow my manual WordPress malware detection checklist. A scanner cannot see every hidden plugin or altered capability. After remediation, monitor new users, plugin changes, logins, and outbound traffic for several days.

What to record during the check

Write down the site’s UpdraftPlus version, whether UpdraftCentral Cloud was ever connected, current local keys, plugin directories inspected, the administrator/editor list, and the dates covered by your logs and backups. Separate confirmed findings from assumptions. If a suspicious plugin is present, keep its file hash and a copy of the code before replacing it, then compare the account and file timeline. This record helps you explain why a site was assessed as exposed, compromised, or clear within the available evidence. Recheck after cleanup because an overlooked scheduled task or second loader can recreate what you removed.

Quick questions

Does every UpdraftPlus installation need malware removal?

No. The incident-specific risk concerns sites connected to UpdraftCentral Cloud. Check the connection and evidence before concluding that a site was compromised.

Is updating UpdraftPlus enough?

The update revoked affected old keys, but it cannot remove a plugin or account installed before revocation. Inspect the site independently.

Can I reconnect to UpdraftCentral?

TeamUpdraft says you can reconnect after completing the security checks, cleaning suspicious items, and securing the site. Use its current incident notice for the latest instructions.

Sources: TeamUpdraft incident notice, updated October 29, 2026; Patchstack campaign analysis. This is an incident-response checklist based on published research, not a claim that I examined the affected sites in that report.