On October 19, 2026, TeamUpdraft, the company behind the UpdraftPlus backup plugin, published a notice about unauthorized access to teamupdraft.com over the weekend of October 17 and 18. It believes its customer database was accessed. That database holds the connection keys for UpdraftCentral, the cloud dashboard that sends commands to connected WordPress sites.

Those keys were then used to create admin accounts and install malicious plugins on connected sites. TeamUpdraft says the plugin itself and its downloads were not affected.

No bug was needed. The attacker used the same channel a legitimate admin uses.

I run enhanced.io, a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. If you manage client WordPress sites, this one sits outside your normal patch report. Here is why, and what to do about it.

Why one cloud dashboard puts every client site at risk

UpdraftCentral cloud lets you manage many WordPress sites from one place. Each connected site trusts commands signed with its connection key. TeamUpdraft’s notice is clear that those keys send commands to the sites they connect to.

Now apply that to an MSP. One dashboard account holds the keys to every client site you connected to it. Whoever holds those keys reaches all of them at once.

That’s why TeamUpdraft tells you to log in to each site directly rather than through UpdraftCentral. The dashboard is the channel you are checking. You don’t use it to check itself.

It’s the same pattern as an RMM or any other management tool with standing access to client systems.

Why patched is not the same as safe

The plugin did what it was built to do. It received a command signed with a valid key and ran it.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) just after 10pm BST on October 19. Those versions revoke the old connection keys, and WordPress.org pushed the update to all sites. That closes the channel. It does nothing about an admin account or plugin added before the channel closed.

So a site on the latest version still needs checking. TeamUpdraft asks Premium users to look for unexpected plugins and new admins even if they have never used UpdraftCentral.

H2  What MSPs should do now

Log in to each client site’s own WordPress dashboard, not through UpdraftCentral. Then work through this list.

1. Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium), or later.

2. Remove the connection keys. Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete the key.

3. Check admins. Go to Users and remove any administrator account you don’t recognize.

4. Check plugins, including must-use plugins. Open the Plugins screen and the Must-Use tab, and remove anything you don’t recognize.

5. Change every administrator password on the site.

6. If anything looks wrong, restore from a backup taken before October 17. Then re-authorize remote storage and change the storage access keys.

My advice would be to reconnect only the sites that need central management. Every connection you leave in place is another key someone else holds.

Secure your own teamupdraft.com account

The same database held more than keys. TeamUpdraft lists names, email addresses, billing addresses, order history, hashed passwords and two-factor settings.

If your team has a teamupdraft.com account, change the password by typing the address into your browser rather than following a link. Reset two-factor authentication in My Account. Change the password anywhere else it was reused. And tell your engineers to treat any email claiming to come from TeamUpdraft with suspicion. The vendor says it will never ask for passwords or keys.

Look at every standing connection in your stack

Start with a list. Every tool in your stack that holds a standing connection into client systems belongs on it: backup dashboards, RMM, remote access and plugin managers.

For each one, answer 3 questions. Who holds the keys? Do they expire? How fast would you revoke them across every client?

Your patch status tells you which version is installed. It doesn’t tell you who else has been sending commands to the site. You need both answers.

Run the 6 checks above on every client site today.

Key takeaways

• TeamUpdraft believes UpdraftCentral connection keys were taken from its customer database on October 17 and 18, 2026.

• Those keys were used to create admin accounts and install malicious plugins on connected WordPress sites.

• UpdraftPlus 1.26.13 and 2.26.13 revoke the old keys but do not remove anything already installed.

• Check every client site for unknown administrators and unknown plugins, including the Must-Use tab.

• List every tool in your stack with standing access to client systems, and know how fast you would revoke its keys.

About enhanced.io

enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. We work only through MSP partners and never sell direct to end clients. To talk about how enhanced.io fits your stack, book a partnership conversation with Hannah Lloyd.