UpdraftCentral Keys, WordPress Backdoors, And The Fix That Has A Gap

🔍 Read the full analysis: UpdraftCentral Keys, WordPress Backdoors, And The Fix That Has A Gap on ThorstenMeyerAI.com

TeamUpdraft said on October 19 that attackers accessed its website over the October 17–18 weekend and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say attackers used stolen keys to send commands that installed backdoor plugins on WordPress sites, including sites running current software. TeamUpdraft’s UpdraftPlus 1.26.13 update revokes some exposed keys, but does not remove backdoors already installed and leaves a set of keys for manual revocation.

According to TeamUpdraft’s incident notice, the database included customer names, email addresses, billing addresses, order histories, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card details; Stripe and PayPal process payments. It also said backups stored by customers with services such as Google Drive, Dropbox or Amazon S3 were not affected. For sites connected through UpdraftCentral, TeamUpdraft recommends re-authorizing storage and rotating its access keys.

TeamUpdraft says the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It says it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated payment-provider keys. The company has reported the breach to the UK Information Commissioner’s Office. It has not disclosed how many customers or WordPress sites may be affected.

Researchers at Patchstack analyzed commands used in the attack and reported that attackers sent a signed plugin.upload_plugin command, which caused WordPress to install and activate an uploaded plugin. Patchstack counted 99 plugin names installed during the observed attack period, including “Site Health Cache” and “Seo Helper.” A frequently seen description was “Small maintenance toolkit: keeps option storage tidy.” The names may vary, so researchers advise treating the description and other indicators as clues rather than relying on one plugin name.

Nethemba said it found the attack on three of its own sites and concluded that keys leaked from the UpdraftCentral Cloud environment were used from an attacker-controlled server. The firm said its analysis did not point to a modified plugin, weak cryptography or the older vulnerability CVE-2026-10795, which it says was fixed in June in version 1.26.5. These are researchers’ findings; TeamUpdraft has not published a customer or site count.

Why Stolen Keys Bypassed Updates

The incident matters because the exposed credentials were not ordinary website passwords. An UpdraftCentral connection key authorizes the dashboard to send signed commands to a connected site. According to Patchstack, the commands passed the plugin’s normal checks because they carried genuine dashboard signatures. That means the reported attack did not require a new software flaw or an outdated WordPress installation: valid stolen keys could authorize plugin installation.

UpdraftPlus includes an UpdraftCentral client that remains inactive until connected. The source material says the connection option is checked by default when a TeamUpdraft account is linked in settings, and that keys do not expire. Nethemba reported seeing keys created in November 2025 used after the breach. Site owners may therefore need to investigate connections they do not recall setting up, rather than assuming only recently created keys matter.

Removing the exposed key closes one route for further remote commands; it is not proof that a site is clean. The described backdoor can create a privileged account and persistent login access, and the account may remain after the plugin is deleted. Some variants reportedly hide from the plugin list. A site where a backdoor was found should be treated as compromised and reviewed beyond simply updating UpdraftPlus.

From Disclosure to Key Revocation

TeamUpdraft’s October 19 notice followed access to its teamupdraft.com website over the weekend of October 17 and 18. The company said it believed attackers reached its customer database. That database held UpdraftCentral Cloud keys, which connect managed WordPress sites to the hosted dashboard. The source material says backups sent directly to a customer’s own storage were not affected, though linked storage credentials may need to be rotated when UpdraftCentral was used.

TeamUpdraft first released UpdraftPlus 1.26.12 on October 19, intending to revoke all UpdraftCentral Cloud keys created before the incident. Nethemba’s code review found that a bug meant the version deleted no keys. TeamUpdraft then issued versions 1.26.13 (free) and 2.26.13 (Premium). Its changelog described the follow-up as properly applying the revocation in 1.26.12.

Nethemba says the corrected release deletes keys created before 12:07 UTC on October 18. It reports that keys created from 12:07 to 21:00 UTC that day are not deleted automatically and require manual removal. TeamUpdraft’s stated cutoff, according to the supplied material, was 22:00 British Summer Time, equivalent to 21:00 UTC. These timing details matter: updating the plugin alone may not revoke every key within the relevant period.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Sites and Keys Still Uncounted

TeamUpdraft has not said how many customers, connection keys or WordPress sites were affected, and the source material does not establish how many sites received a backdoor. The company said it believes attackers reached the database; the scale of access and any misuse beyond the observed commands remain unclear.

The exact number of keys requiring manual deletion is also unknown. The cutoff information comes from the supplied account of TeamUpdraft’s advisory and Nethemba’s code review, while cleanup guidance is described as changing as researchers find variants. The presence of a named plugin is not conclusive on its own, and a site without an obvious plugin entry may still require investigation. TeamUpdraft has not provided a complete public account of the breach’s cause or a final impact assessment in the material available here.

Apply the Patch and Check Sites

Site owners using UpdraftPlus should install the applicable updated release and consult the latest TeamUpdraft advisory for instructions on checking and manually revoking keys created during the reported gap. Those who used UpdraftCentral should review connected sites and re-authorize external storage or rotate storage access keys as TeamUpdraft recommends.

If a suspicious plugin, account or other backdoor indicator is found, the update should not be treated as cleanup. Researchers warn that removing only the plugin may leave an account behind, and some versions may be hidden. Administrators should follow current guidance from TeamUpdraft, Patchstack and Nethemba and investigate the site as compromised. TeamUpdraft’s next public update, including any figures on affected customers and sites or further remediation instructions, has not been specified in the supplied material.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke certain exposed connection keys. According to the supplied research, it does not remove an installed backdoor or any account that backdoor created.

Which UpdraftPlus versions were released to address the key exposure?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium on October 19, 2026. Nethemba said the earlier 1.26.12 release did not revoke keys because of a bug.

Are all exposed UpdraftCentral keys revoked by the update?

Not according to Nethemba’s review. It reported that keys created from 12:07 to 21:00 UTC on October 18 are not deleted automatically and need manual removal. Site owners should check TeamUpdraft’s current instructions for their connection keys.

Were payment details or customer backups exposed?

TeamUpdraft said it did not store payment-card data because Stripe and PayPal handle payments. It also said backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected. It recommends re-authorizing storage and rotating access keys for sites connected through UpdraftCentral.

How many sites were affected?

TeamUpdraft has not disclosed a customer or site count. Patchstack reported 99 different plugin names during its observed attack window, but that figure is not a count of affected sites.

Source: ThorstenMeyerAI.com