Attackers who broke into TeamUpdraft’s own website on October 17 or 18 walked away with keys that let them command WordPress sites running UpdraftPlus, a backup plugin installed on more than 3 million sites. Search Engine Journal reported the incident Wednesday. For SEO teams, a hijacked site is a ranking problem as much as a security one, because whoever controls the plugins controls what Google crawls.

TeamUpdraft says it believes the intruders reached a customer database that stored customer records plus the keys tying sites to UpdraftCentral and similar services. That is the plugin’s remote dashboard, built to manage many WordPress installs from one place. The keys authenticate commands sent to each site, so no username or password is needed.

Patchstack, a security firm, described the problem in its first analysis as a key compromise and not a software flaw. Its statement, quoted by Search Engine Journal: “This is not a vulnerability in UpdraftPlus, and as of 19 October no plugin update stops it.” Every check in the plugin passed, because the commands were correctly signed with genuine private keys.

With that access, attackers told sites to add and switch on rogue plugins through WordPress’s ordinary installer. Those plugins carried a backdoor that created an Editor-role account and then quietly granted it administrator capabilities. The backdoor also skipped the normal login flow, so 2FA and brute-force throttling never came into play.

Patchstack found 99 different plugin names in use, including one called Site Health Cache. Many resembled routine maintenance or performance tools, which makes a casual scan of the plugin list unreliable. Patchstack also noted a coding error that made affected sites throw server errors ahead of the backdoor firing, though that did not make the plugins safe to leave in place.

Exposure is wider than the plugin’s purpose suggests. Patchstack reported that linking a site to a TeamUpdraft account could create an UpdraftCentral connection by default, since remote management was preselected. A site used only for backups may therefore hold live keys its owner never knew about. The incident covers free and premium versions, but only sites with active UpdraftCentral Cloud connections. TeamUpdraft says self-hosted UpdraftCentral installations were unaffected.

TeamUpdraft released UpdraftPlus 1.26.13 for free users and 2.26.13 for premium on October 19. The updates revoke the older keys and disconnect affected sites from UpdraftCentral. According to the company, WordPress.org pushed the update to users automatically.

The patch closes the door but does not sweep the house. It removes neither malicious plugins nor rogue accounts already installed. TeamUpdraft’s checklist for site owners, including those who never knowingly used UpdraftCentral:

The company says it sees no sign that attackers remain inside its infrastructure, though the investigation is not finished.

The source does not address search consequences, so treat this as inference. Compromised WordPress sites are a routine route for injected spam pages and redirects, which are what trigger hacked-content warnings, manual actions, and deindexing. An admin-level backdoor gives an attacker everything needed to do that. Agencies managing client WordPress installs should audit plugin lists and administrator accounts across every site this week, then check Search Console security and manual-action reports for anything unexpected.

Search Engine Journal, reported by Roger Montti on October 21, 2026.