If a South Florida business runs its website on WordPress and an agency or freelancer handles the upkeep, this is a good week to ask for more than an update receipt. UpdraftPlus, one of the most widely used WordPress backup plugins, shipped a new version on Oct. 26 that changes how sites join its remote management service. That update follows a security incident at the company behind the plugin, and the practical lesson for owners is simple: updating the software, checking who has access and confirming backups still arrive are three separate jobs.
A new default, not a clean bill of health
The UpdraftPlus changelog lists version 1.26.14, dated Oct. 26, 2026, with a change that turns off automatic addition of websites to UpdraftCentral, the plugin's remote management dashboard, when a site connects. Owners who want that behavior now have to switch it on themselves.
That change is about how connections work going forward. The same changelog shows two Oct. 19 releases: version 1.26.12 revoked UpdraftCentral cloud keys created before the incident, and version 1.26.13 corrected that release so the revocation applied properly. A site showing the latest version number is a good sign, but it does not by itself tell you whether anyone used the old access route before it was closed, or whether backups are still landing where they should.
What the company says happened
TeamUpdraft's incident notice says it identified unauthorized access to teamupdraft.com over the weekend of Oct. 17 and 18 and believes its customer database was accessed, including connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company says the plugin itself and its downloads were not affected, that backups sent to an owner's own storage such as Google Drive, Dropbox or Amazon S3 were not affected, and that self-hosted UpdraftCentral was not affected. It also says it does not store card details.
The vendor has asked UpdraftPlus Premium customers to check their websites for unusual activity, such as unexpected plugins or new administrators, even if they have never used UpdraftCentral. Those are the company's own statements about its investigation, which it says is ongoing, not an independent audit of customer accounts.
Check the connection, not just the plugin name
Monarx, a server security company, reported on Oct. 19 that it was seeing fake plugins installed on WordPress sites through the UpdraftCentral command channel across its hosting partner network. Its explanation is useful for owners: a connected site runs commands signed with the matching key, so stolen keys let an attacker send instructions the site treats as legitimate. Monarx identifies sites with an active UpdraftCentral connection key as the exposed group, whether they run the free or premium plugin.
That is why the right question for your webmaster is whether the site ever had a cloud management connection, not simply whether a backup plugin is installed. Monarx also notes that the internet addresses tied to the activity can change, so blocking a published address is a starting point for reviewing logs, not proof a site is safe.
What to ask your web person this week
For an owner, the goal is a short, specific conversation with whoever manages the site. Based on the steps TeamUpdraft and Monarx have published, these are fair questions:
- Is UpdraftPlus on the current version on every site we own, including the ones nobody touches day to day?
- Did any of our sites hold an UpdraftCentral connection key, and has it been removed or replaced from the site's own dashboard?
- Has someone reviewed the user list for accounts we do not recognize? TeamUpdraft says it has seen a pattern of unexpected Editor roles.
- Has someone reviewed the plugin list, including Must-Use plugins, for anything nobody on our side installed?
- Have administrator passwords been changed, and has the TeamUpdraft account password been changed if we have one?
TeamUpdraft also suggests that account holders log in to UpdraftCentral through My Account and look at the list of connected sites. A site on that list that nobody knowingly connected since Oct. 19 is worth checking closely.
Separate account recovery from backup recovery
TeamUpdraft asks everyone with a teamupdraft.com account to change that password, change it anywhere else it was reused and reset two-factor authentication if it was turned on. It also says every site was disconnected from UpdraftVault, its paid backup storage, so backups will not reach Vault until the site is reconnected. After reconnecting, the company recommends running a manual backup to confirm it works.
For an owner, that means a successful login is not the same as a working backup. Ask for a dated backup result and the place it was stored. If your site was accessed through UpdraftCentral, the vendor also recommends reauthorizing your own remote storage, such as Google Drive or Dropbox, and changing any storage access keys as a precaution.
Give the host evidence before cleanup
WordPress's own guidance for hacked sites recommends documenting what you are seeing, when you noticed it, what changed recently and details about your hosting setup. It also recommends checking with the hosting provider, since a problem may reach beyond one site on shared hosting.
A useful handoff from the owner's side is a short note covering what looked wrong, who is looking into it and which access points have been reviewed. Avoid treating an unfamiliar plugin name alone as an instruction to start deleting business software. Let the administrator or host confirm what it is and handle any cleanup with a recovery plan, which may include restoring from a backup taken before the incident.
Sources
- UpdraftPlus release history on WordPress.org
- TeamUpdraft security incident notice
- Monarx security advisory
- WordPress documentation: My site was hacked
Related
- From Claude Design to WordPress: a new web workflow
- AI tools South Florida businesses are actually using
Key Facts
What changed in the Oct. 26 UpdraftPlus update?
Version 1.26.14 turns off, by default, the option that automatically adds websites to UpdraftCentral when they connect, according to the changelog. Owners who want automatic addition must now enable it themselves.
Does having UpdraftPlus mean a site was compromised?
No. Monarx identifies an active UpdraftCentral connection key as the exposure for this attack route. Sites with a key should be reviewed for unfamiliar users and plugins rather than assumed safe or unsafe.
Do free plugin users need to act?
TeamUpdraft says free users without a teamupdraft.com account do not need incident action beyond keeping the plugin updated. Monarx notes free sites with an active UpdraftCentral key are still in the exposed group.
Why check backup delivery separately?
TeamUpdraft says every site was disconnected from UpdraftVault, so backups will not reach Vault until the site is reconnected. The company recommends a manual backup afterward to confirm delivery works.
What should owners write down before asking for help?
What looks wrong, when it was noticed, recent changes and hosting details, following WordPress's guidance. Then check with the hosting provider, which may be able to see more than one site.
