Levamo put the figure at more than 100 compromised sites

UpdraftCentral is a remote site management service from TeamUpdraft, the company behind UpdraftPlus. Its client ships inside every copy of UpdraftPlus, free and premium. When a site is connected to UpdraftCentral, it generates an RSA key pair and stores the dashboard's public key. From that point on, the site executes any command signed with the dashboard's private key, with the permissions of the administrator who created the connection.

The attacker breached the UpdraftCentral Cloud environment and obtained those dashboard private keys. With them, the attacker can install and activate any plugin on any connected site, without the site owner knowing.

TeamUpdraft's incident report confirms the attacker accessed their customer database, which includes names, email addresses, billing addresses, order history, hashed (not plaintext) passwords, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Payment details were not exposed (those are handled by Stripe and PayPal).

TeamUpdraft says they have closed the access route, signed out of every account, and replaced compromised keys and credentials. They are also preparing an emergency UpdraftPlus release that will automatically disconnect every UpdraftCentral connection made before 22:00 BST on October 18, so the old keys stop working on every site. That release has not shipped yet.

The commands are properly encrypted and signed with genuine keys. Every security check in the plugin passes because, from the site's perspective, the instruction is legitimate.

Every WordPress site running UpdraftPlus (free or premium) that has an active UpdraftCentral key is at risk.

Here's the part that catches people off guard: you may have an active key even if you never intentionally used UpdraftCentral. When you connect your TeamUpdraft account in the UpdraftPlus settings, there's a checkbox that reads "Add this website to UpdraftCentral (remote, centralised control)." It's checked by default. Leave it ticked (which many site owners do without noticing) and your site gets an UpdraftCentral key with full admin permissions.

Patchstack's security team confirmed they're seeing sites with active UpdraftCentral keys whose owners only ever used UpdraftPlus for backups .

Sites without an UpdraftCentral key are not affected. The UpdraftCentral client is dormant without a key. Self-hosted UpdraftCentral installations are also not affected, since the compromised keys came from TeamUpdraft's cloud environment, not from self-hosted dashboards.

If you use UpdraftVault or UpdraftClone: TeamUpdraft has disconnected all sites from UpdraftVault and replaced every UpdraftClone client key. Your Vault backups won't sync until you reconnect with your new password. Backups sent to your own remote storage (Google Drive, Dropbox, Amazon S3) are not affected.

What the Attacker Is Doing

The attacker is sending plugin.upload_plugin commands through the UpdraftCentral channel to install backdoor plugins on connected sites. The attack follows a consistent pattern:

Probe. The attacker sends a message to a non-existent key ( probe.central.updraftplus.com ). The site responds that it doesn't understand, which confirms it accepts UpdraftCentral commands.

Install. A few hours later, the attacker sends the real command with the site's actual key. WordPress installs and activates the malicious plugin through its standard installer.

The whole thing happens silently. No notification, no confirmation prompt, no log entry your average site owner would ever check.

What the Backdoor Plugin Does

Every backdoor plugin is generated from the same template but with randomized names, tokens, and credentials. Here's what it's designed to do:

Create a hidden admin account. The plugin hooks into every WordPress request and watches for a secret URL parameter. When triggered, it creates a user account with:

The Editor role (so it doesn't show up when you review your administrator list)

Two extra capabilities: manage_options and install_plugins (giving it full admin control despite looking like an Editor)

An email address at @example.org

The display name "Site Tools"

A username in the format "word-word" plus two digits (confirmed examples: data-ops43 and media-staff96 )

Bypass all login protections. The plugin logs the attacker in by setting an authentication cookie directly. This skips the WordPress login form entirely, which means two-factor authentication, login attempt limits, and any login-protection plugins never run.

Persist after removal. Even if you delete the plugin, the user account stays in WordPress with its known password. The attacker can log back in through the normal login form.

The good news: the current batch of backdoor plugins contains a coding bug that crashes the site with a PHP error before the backdoor can activate. That's actually how the first victims discovered it (their sites went down). But the attacker only needs to fix a few characters for the wave to work silently. Do not assume the bug will protect you.

How to Check if Your Site Is Affected

Check for UpdraftCentral Keys

In your WordPress admin, go to Settings, then UpdraftPlus Backups, then Advanced Tools, then UpdraftCentral . If you see any keys listed under "Manage existing keys," your site is connected and was exposed.

Check for the Backdoor Plugin

Look through your plugin list for anything with the description:

Small maintenance toolkit: keeps option storage tidy.

Small maintenance toolkit: keeps option storage tidy.

The plugin names are randomized (examples include "Site Health Cache," "Load Stack 35C," "Fast Engine," "Seo Helper," and dozens more), so don't by name. Match on the description.

If your site is returning error 500 on every page and you can't access the admin, that's actually the backdoor's bug crashing the site. You'll need command line or SFTP access to remove it.

Check for Suspicious User Accounts

Go to Users in your WordPress admin and look for:

Any account with the display name "Site Tools"

Any account with an @example.org email address

Any Editor account you don't recognize, especially with a username like "word-word" followed by two digits

If you find an account matching these markers, the backdoor was activated on your site. Change all administrator passwords immediately, remove the account, and reach out to your hosting provider.