UpdraftPlus / UpdraftCentral Backdoor: How to Check and Clean Your WordPress Site

Last updated: 23 October 2026. Based on TeamUpdraft’s security advisory (updated 22 October) and analysis by Patchstack and Nethemba. The detection commands below were tested against sample data. The investigation is ongoing; check the vendor advisory for updates.

If your WordPress site uses UpdraftPlus, the popular backup plugin, take 15 minutes today to check it. On 17–18 October 2026 attackers broke into the website of TeamUpdraft, the company behind UpdraftPlus, stole UpdraftCentral connection keys, and from 18 October used them to install backdoors on connected WordPress sites. This guide shows how to tell whether your site is at risk, how to check for the backdoor, and how to clean up.

Are you affected?

The UpdraftPlus plugin code and downloads were not modified, and backups stored in your own remote storage were not affected. About 10% of UpdraftPlus sites hold an UpdraftCentral key, which could mean around 400,000 sites. Note that the option to connect to TeamUpdraft.com was ticked by default, so check even if you do not remember using UpdraftCentral.

Step 1: Update UpdraftPlus and delete old keys

1. Log in to each site’s own WordPress dashboard (not through UpdraftCentral).
2. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. The earlier 1.26.12/2.26.12 release had a bug that did not remove the keys.
3. Go to Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys and delete every key. Removing the site from the UpdraftCentral dashboard is not enough, because the key is stored on your site.

With WP-CLI you can check and remove the keys from the command line:

wp plugin list --name=updraftplus --fields=name,status,version
wp option get updraft_central_localkeys      # shows whether the site holds keys
wp option delete updraft_central_localkeys   # removes them

Only reconnect to UpdraftCentral after you have completed the checks below.

Step 2: Check for the backdoor

Patchstack and TeamUpdraft describe these warning signs:

• Unknown plugins with random names such as “Asset Forge 2”, “Block Dock A96”, “Tiny Sweep 5” or “Site Health Cache”. At least 99 different names were used, so look at the description: every sample has “Small maintenance toolkit: keeps option storage tidy.” Check the Must-Use plugins tab too.
• Unknown users with the Editor role that have extra admin capabilities. Usernames follow a word-word-two-digits pattern (for example data-ops43, media-staff96), often with an @example.org email and the display name “Site Tools”.
• A database option ending in _sync_token.
• Unexpected HTTP 500 errors or WordPress error emails naming a plugin you do not recognise (the backdoor samples contain a coding error).
• Activity in the observed attack window, 18 October 15:32 UTC to 19 October 09:23 UTC, though you should check from 17 October onwards.

If you have shell access, these checks (adapted from Patchstack’s analysis) help. Adjust the paths and the wp_ table prefix to your installation:

# 1. Backdoor plugins: match the shared description
grep -rl "Small maintenance toolkit: keeps option storage tidy\." /var/www/*/wp-content/plugins/

# 2. Editor accounts that were given admin capabilities
wp db query "SELECT u.user_login,u.user_email FROM wp_users u JOIN wp_usermeta m ON m.user_id=u.ID WHERE m.meta_key='wp_capabilities' AND m.meta_value LIKE '%editor%' AND m.meta_value LIKE '%manage_options%'"

# 3. The backdoor's trigger parameter in web server access logs
grep -E '[?&]_[A-Za-z0-9]{4,10}=[A-Za-z0-9_]{32}([&"[:space:]]|$)' /var/log/nginx/access.log

# 4. Suspicious UpdraftCentral requests without the normal version details
grep 'class-udrpc\.php"' /var/log/apache2/*access*

On shared hosting without shell access, review Users and Plugins in wp-admin, download your access logs from the hosting panel, and ask your host to scan the site.

Step 3: If you find signs of compromise

1. Treat the whole site as compromised. The attacker could run code, so removing one plugin may not remove everything.
2. Do not “repair” the backdoor plugin. Fixing its coding error activates it. Deactivate it and move it out of the web root using your hosting file manager or SSH, keeping a copy as evidence.
3. Remove the attacker’s accounts and the _sync_token option, and review every user with elevated capabilities.
4. Restore from a clean backup taken before 17 October 2026 if possible, and compare files with a fresh WordPress and plugin download.
5. Rotate credentials: all WordPress admin passwords, database password, hosting and SFTP passwords, and the access keys for your remote backup storage. End all sessions and enable two-factor authentication.

Step 4: Secure your TeamUpdraft account

• Change your teamupdraft.com password by typing the address yourself, not from an email link, and change it anywhere else you reused it. All accounts were signed out by the vendor.
• Reset two-factor authentication in My Account if you use it.
• UpdraftVault users: reconnect each site under Settings → UpdraftPlus → Settings and run a manual backup to confirm it works.
• UpdraftClone users: all client keys were replaced; send clients the new keys from your account.
• Beware of follow-up phishing pretending to be TeamUpdraft. The company says it will never ask for your password or keys.

Lessons for WordPress site owners

Remote management tools are powerful: whoever holds the key can control your site, and a breach at the vendor becomes a breach of every connected site. Connect only the services you actually use, remove old keys and integrations, give remote tools the minimum permissions they need, keep offline or separate backups, and monitor for new admin users and plugins. The same week also brought the PHP2Shell flaws in PHP itself; use our 15-minute WordPress checklist and see the “Black October” fact-check for everything else.

Need help checking or cleaning a WordPress site? See our VAPT services or contact us.

Sources

• TeamUpdraft: security incident advisory (October 2026)
• Patchstack: UpdraftCentral key compromise and WordPress backdoors
• Nethemba: UpdraftCentral backdoor analysis
• BleepingComputer: stolen UpdraftCentral keys used to backdoor WordPress sites