If you use UpdraftCentral cloud, check every connected WordPress site now. Changing your TeamUpdraft password is only part of the response. TeamUpdraft says connection keys in its customer database may have been accessed, and those keys can send commands to connected websites. Its advice is to secure each site directly. The emergency release is now available, followed by a correction to its key-revocation behaviour; update through a trusted channel and complete the site-level checks below.
The official TeamUpdraft security advisory, published on 19 October 2026, describes unauthorised access identified over 17-18 October. It says the UpdraftPlus plugin itself and its downloads were not affected. This is a vendor-account and connected-service incident, with different actions for UpdraftCentral, UpdraftVault and UpdraftClone users.
Updated on 20 October 2026: TeamUpdraft now confirms the emergency release. The official UpdraftPlus changelog lists 1.26.12 as revoking affected UpdraftCentral Cloud keys, then 1.26.13 as correcting that revocation. Do not stop at 1.26.12: use the latest trusted release containing the correction. The changelog also applies to corresponding Premium releases, whose version numbers begin with 2. An update is not proof that a previously accessed site is clean.
Who needs to act?
Start with the services your business actually uses. An installed backup plugin, a TeamUpdraft customer account, remote administration and cloud backup storage are different things. If an agency set everything up, ask it to confirm the connections on the website itself.
| Your setup | What to do first | What confirms progress |
|---|---|---|
| TeamUpdraft account | Change the account password and reset its two-factor authentication if enabled. | A unique new password and newly configured account security. |
| UpdraftCentral cloud connection | Log in directly, update to the corrected release and remove the old connection key as instructed. | The installed version is confirmed; the old connection is absent and site accounts and plugins have been reviewed. |
| UpdraftVault storage | Reconnect with the secured account, save the settings and run a manual backup. | A successful backup reaches the intended Vault destination. |
| UpdraftClone client keys | Replace old keys wherever you or your authorised clients use them. | The intended clone workflow uses the replacement key. |
| Free UpdraftPlus with no TeamUpdraft account | The vendor says no incident-specific action is needed. | Confirm this is genuinely your setup, including any agency-managed connections. |
TeamUpdraft’s notice says self-hosted UpdraftCentral and backups sent to your own remote storage, such as Google Drive, Dropbox or Amazon S3, are unaffected. However, it adds an important precaution: if your website was accessed through UpdraftCentral, re-authorise its remote storage and change access keys where applicable. Ask the storage owner to coordinate this without losing access to recovery copies. These distinctions do not cancel password-reset advice for a separate TeamUpdraft account.
What TeamUpdraft says was accessed
TeamUpdraft says it believes its customer database was accessed. The categories it lists include customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone.
Hashed passwords are not stored as readable passwords. That distinction matters, but it does not make a password reset optional: follow the vendor’s reset instruction, and replace the same password anywhere you reused it. Do not reuse the replacement across accounts.
The customer email says full card numbers were not stored and payments are handled through Stripe and PayPal. Neither that statement nor a healthy-looking website establishes that every connected site is clean. The advisory describes a potential route into sites through remote-management keys; it does not establish that every UpdraftPlus installation was compromised.
TeamUpdraft says it closed the access route, signed out accounts, reset login security, replaced affected service credentials and rotated keys for payment providers and other connected services. It also disconnected sites from Vault and replaced Clone client keys. The site-specific work below still needs an owner.
UpdraftCentral users: disconnect the old key today
A remote-management connection is a separate access route from an ordinary browser login. TeamUpdraft explicitly warns that its UpdraftCentral keys can send commands to connected sites. Resetting the account password is therefore not a substitute for removing the old connection on each website.
1. Open the site’s own WordPress dashboard
Use your normal trusted login address for the website. Do not use UpdraftCentral to perform these checks. Confirm that you are on the correct domain before entering credentials, especially if you manage staging sites, old domains or several businesses.
If direct administrator access fails, contact the hosting provider or the person responsible for the site through a known channel. Do not install an unfamiliar login or recovery plugin from an unsolicited message to get around the problem.
2. Update and remove the old connection
Check the installed UpdraftPlus version on the site’s own Plugins screen. For the free plugin, the verified correction is 1.26.13; Premium users should obtain the corresponding latest release through their legitimate account. Record the version after the update, then verify the old connection is gone. If updating fails or access is unclear, contact the host or vendor rather than treating an attempted update as completion.
The vendor’s route is Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. Delete the old connection key there. Repeat this for every connected site, including old sites you rarely visit. Record the site, the person completing the action and the time, but keep key values out of shared notes, screenshots and support tickets.
If you do not see the expected panel or cannot tell which connection belongs to the affected cloud account, stop guessing and use TeamUpdraft support or your site administrator. Removing the plugin or changing an unrelated setting is not proof that the relevant remote authorisation has been revoked.
3. Review users and plugins
TeamUpdraft instructs owners to remove unrecognised administrator accounts and plugins. Its public update includes the Must-Use plugins tab where available. Check both active and inactive plugins; do not limit the review to what appears on the homepage.
For a business site, pair that instruction with evidence preservation. A hosting integration or agency account can be unfamiliar but legitimate. Confirm ownership promptly; if an account or component is unauthorised, have the administrator or host contain it and preserve the relevant logs and files before cleanup. Do not leave confirmed malicious access enabled while conducting a leisurely review.
Our unknown WordPress administrator guide explains how to verify ownership without destroying useful evidence or deleting the wrong person’s content. If the site crashes before you can reach Plugins, ask the host to help isolate the failing component and preserve a copy outside public access.
4. Reset administrator passwords
Follow the vendor’s instruction to change the passwords for all administrator accounts on the site. Coordinate with the actual account owners, use unique passwords and review available session controls with your administrator. Do this across the affected site list, not just the site that happened to show an error.
5. Reconnect after the site review
The vendor’s sequence ends with reconnection to UpdraftCentral. If you have found suspicious activity, finish containment and establish a recovery plan before restoring remote access. Reconnection should be deliberate, recorded and performed through the legitimate service using the secured account.
The advisory gives the affected connection cutoff as 22:00 BST on 18 October, equivalent to 21:00 UTC. It says connections recreated through its recovery procedure are not targeted by that revocation. Verify the corrected plugin version and the actual connection state; neither replaces the review of changes already made to the site.
UpdraftVault users: verify that backups reach storage
There is a second operational risk even if the site appears normal: TeamUpdraft says all sites were disconnected from UpdraftVault. Backups will not reach Vault until the connection is restored. A previously configured schedule is not evidence that a new off-site backup completed.
- Secure the TeamUpdraft account first, using the new password.
- On each site’s dashboard, open Settings > UpdraftPlus > Settings.
- Select UpdraftVault under remote storage. Under Already got space?, choose Connect.
- Enter the account email and new password in the legitimate plugin connection interface, then complete the connection and select Save Changes.
- Run a manual backup and check the final result, including delivery to Vault.
Check what the backup actually contains. If you need both the database and site files, a successful database-only job is not the same as a complete recovery set. Keep a record of the completion time and destination without copying credentials into the record.
Do not delete older recovery copies just because a new backup completes. A new backup preserves the current state, which may still require investigation. Keep pre-incident copies separate from the fresh evidence copy. Our WordPress backup restore test guide covers verifying recoverability in an isolated environment.
UpdraftClone users: replace client keys carefully
TeamUpdraft says every Clone client key has been replaced and the previous keys no longer work. Retrieve replacement keys from My Account > UpdraftClone > UpdraftClone Key Management. If you have never created a client key, the updated advisory says you do not need to perform this step.
If clients or colleagues use a key you issued, confirm the intended recipient through your established channel and arrange a secure handover. Do not put replacement keys in public tickets, ordinary project notes or screenshots. Record who received the replacement and whether the intended workflow works, without recording the key itself.
Should you restore a backup from before 17 October?
TeamUpdraft says to consider a backup from before 17 October if you find something suspicious. Treat that as a recovery decision, not an instruction to overwrite every site immediately.
A whole-site restore can remove legitimate orders, bookings, customer records, content changes and form entries created after the backup. On a store, that can create a second incident while you are trying to resolve the first. A backup date alone also does not prove the copy is clean.
Before a live rollback, ask the recovery person to preserve the current state and available logs, identify the suspected compromise window, assess the candidate backup, and explain how newer business data will be reconciled. Test recovery away from the public site where practical. If active harm is continuing, the host may need to restrict access or isolate the site while preserving evidence.
Restoring files without revoking the affected remote connection can leave the access problem unresolved. Similarly, removing a suspicious plugin does not establish that no other changes occurred. The recovery check must cover access, persistence, affected data and the site’s essential customer journeys.
For stores, read what to check when WooCommerce orders are missing after a restore before importing or replaying transactions. Do not charge customers again simply because the restored database has no record of their original payment.
What to record for your host or recovery specialist
The most useful handoff is a concise record of what you observed and changed. Keep original logs and suspicious files in a restricted evidence location. Do not execute a suspicious plugin to see what it does, and do not upload private files to a public scanner or forum.
| Evidence | Useful detail | Important limit |
|---|---|---|
| Remote connections | Service, affected site, connection age if visible, and revocation time. | Keep the actual keys private. |
| Unexpected changes | Account or plugin involved, discovery time and who authorised it, if known. | An unfamiliar name alone does not prove malicious activity. |
| Logs | Relevant hosting, application and management events with timezone and coverage dates. | A gap in retained logs is unknown activity, not proof nothing happened. |
| Recovery copies | Backup time, contents, destination and restore-test result. | A completed backup is not automatically a clean backup. |
| Business checks | Whether the public site, admin access, forms, checkout and backup delivery work. | Successful rendering does not prove the absence of compromise. |
If a management log attributes an action to a familiar account, ask which access mechanism performed it before blaming that person. Review remote-management events alongside normal login evidence. Keep an observation, an inference and a confirmed finding separate in the incident record.
Questions site owners are asking
Was the UpdraftPlus plugin hacked?
The vendor says its plugin and downloads were not affected by this incident. The disclosed issue concerns access to TeamUpdraft’s website and customer database, including connected-service keys. Avoid treating every UpdraftPlus installation as a confirmed infected site.
Is changing my TeamUpdraft password enough?
Not if you use an affected UpdraftCentral cloud connection. Follow the separate site-level disconnection, review and administrator-password steps. Vault and Clone also have their own reconnection or key-replacement work.
Is the emergency update available?
Yes. The official changelog lists the initial revocation release and its 1.26.13 correction, both dated 19 October. Install the latest applicable release through a trusted channel and complete the vendor’s site-level checks. Updating does not remove every possible unauthorised change or establish that a backup is clean.
Should I uninstall UpdraftPlus?
The advisory does not call for every user to uninstall it. Follow the actions for the services you actually use. Uninstalling backup software without a replacement plan can interrupt backups and does not prove that an affected site’s access routes or unauthorised changes have been addressed.
My website looks fine. Can I skip the checks?
A normal homepage does not verify remote access, administrator accounts or off-site backup delivery. If you have an affected connection, complete the vendor’s checks even when visitors have reported no problem.
How do I avoid fake recovery emails?
Type the vendor’s domain into your browser and use the account’s support route. TeamUpdraft says it will not ask for your password or keys. Treat unexpected attachments, replacement-plugin downloads and requests to send access details as reasons to verify the sender independently.
Get help if you find suspicious changes
If you find unauthorised accounts, unfamiliar plugins, redirects or repeated outages, use a defined recovery process. Webless’s WordPress hacked-site recovery service explains the available scope. Send a short description of the symptom, when it started and what you have already changed. Arrange any credential or evidence handover securely after contact.
For account-specific questions and changes to this incident’s instructions, use TeamUpdraft’s live advisory. Keep a named owner for each affected site until old access has been removed, the account and site have been reviewed, and backup delivery has been verified.