What happened
On October 18, 2026, security researchers began seeing a wave of WordPress sites getting a hidden back door installed. Two security firms, Patchstack and Nethemba, have written up what they found. The sites that were hit have one thing in common: they run UpdraftPlus, one of the most popular backup plugins in the world, with more than four million installs.
This is not a typical "update your plugin" story, and that is why it is worth reading carefully.
Why updating won't fix it
Think of a hotel key card. A well-run hotel locks every door and only the right cards open them. In this case, the locks are fine. What appears to have happened is that a batch of master key cards was copied from the company that issues them, and the person holding the copies is walking from door to door.
UpdraftPlus includes a feature called UpdraftCentral, which lets a dashboard manage your site remotely. Each connection is protected by a private key that stays with TeamUpdraft's cloud service, not on your site. Patchstack's evidence points to those keys having leaked from that service. TeamUpdraft had not published an explanation when Patchstack wrote its report.
Because the commands are signed with a real key, your site cannot tell them apart from the real thing. It does what it is told. A newer version of the plugin does not help, because the plugin is working exactly as designed. As of October 19, no fixed version exists.
What the attackers do once they are in
The attacker uses the key to tell your site to install a new plugin. That plugin looks harmless, often described as a small maintenance toolkit, but it is a back door. With a secret web address only the attacker knows, it can create a hidden user account on your site and log them in, skipping the normal login page entirely. That means two-factor authentication and login-protection plugins never get a chance to stop them.
From there, an attacker can do what any administrator can do: change content, redirect your visitors, steal data, or plant more malicious code. The hidden account also survives if you delete the plugin that created it.
How big is this?
Nobody has published a count of affected sites. Patchstack saw installs spread across a broad set of sites over roughly 18 hours, and found 99 different disguised plugin names, so the attacker was trying hard not to be spotted. Some installs never switched on, but Patchstack says those sites still received the back door and should be treated as affected. The fact that most people have not heard of UpdraftCentral is a big part of the problem, because many site owners do not know they have a key at all.
What to do today
None of these steps need a developer. They take about five minutes.
- Check for keys. In your WordPress dashboard, go to Settings, then UpdraftPlus Backups, then Advanced Tools, then UpdraftCentral. Look for a link that says "Manage existing keys." If it shows a number above zero, your site is exposed. Check this even if you have never used UpdraftCentral. Patchstack notes that keys can be created by a setting that is switched on by default.
- Delete every key. Your backups will keep running. Only remote management stops. Do not reconnect until TeamUpdraft explains what went wrong, even after they release a fix, because the attacker already holds keys issued earlier.
- Look for signs of a break-in. Open your Plugins list and look for anything you did not install, especially one called "Site Health Cache" or described as a "small maintenance toolkit: keeps option storage tidy." Then open Users and look for accounts you do not recognize, such as an Editor with the display name "Site Tools."
- If you find anything, stop and call someone. Delete the keys first. After that, do not just remove the plugin and move on, because the fake account stays behind and the plugin's own removal routine can erase the evidence. A proper cleanup means restoring from a backup taken before October 18, resetting every password, ending all logged-in sessions, and checking every user on the site.
If you manage sites with command-line access, Patchstack's article has the exact commands, a list of the disguised plugin names, and the attacker's IP addresses. Their write-up and the original analysis from Nethemba are linked at the bottom of this post.
If your site is already acting strangely, or you find one of these signs, our emergency support team can step in and contain it.
The bigger lesson
The uncomfortable part of this story is how little your own habits would have mattered. You could have kept every plugin updated, used strong passwords and turned on two-factor authentication, and still been exposed because a feature you never knowingly switched on trusted a key that leaked somewhere else.
That is why remote-access features deserve the same scrutiny as any other way into your site. Somebody should know which of them are switched on, who holds the keys, and what happens when one of those keys goes missing. It is the same gap we describe in WordPress needs someone accountable: the plugin does its job quietly, and nobody is assigned to ask what else it can do. Managed operations exist for exactly this kind of morning, when something outside your control breaks and you need a person, not a support queue.
Sources
This post is based on reporting from Patchstack and the original technical analysis by Nethemba. This is a developing situation, so details may change as TeamUpdraft responds.
