Stolen UpdraftCentral Keys Are Backdooring WordPress Sites. The Fix Has A Gap.

🔍 Read the full analysis: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites. The Fix Has A Gap. on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers had accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys; researchers say stolen keys were then used to install backdoors on WordPress sites, including sites running current software. The company released UpdraftPlus 1.26.13 to revoke some exposed keys, but the update does not remove an installed backdoor and does not revoke every key that may have been exposed.

According to TeamUpdraft’s incident notice, the attackers accessed teamupdraft.com over the weekend of October 17–18. The company believes they reached a customer database containing names, email addresses, billing addresses, order history, password hashes, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card data; Stripe and PayPal process payments. It also said backups sent directly to services such as Google Drive, Dropbox or Amazon S3 were not affected.

Security firms Patchstack and Nethemba described how the UpdraftCentral keys could be abused. UpdraftPlus includes a client that can accept signed commands from the cloud dashboard when a site is connected. Patchstack said attackers used the command plugin.upload_plugin to upload and activate plugins. Because the commands were signed with genuine dashboard keys, the researchers said the plugin’s checks accepted them; this did not require exploiting a software vulnerability, and patched sites could still be affected.

Patchstack counted 99 plugin names in installations observed between the afternoon of October 18 and 09:23 UTC on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” Researchers identified a recurring description, “Small maintenance toolkit: keeps option storage tidy.” They said some variants could create an administrator-like account with additional capabilities and log in through a persistent cookie. TeamUpdraft said UpdraftPlus itself, its downloads and self-hosted UpdraftCentral were not affected.

Why Stolen Keys Bypass Site Defenses

The incident shows that a legitimate management credential can put a WordPress site at risk even when its plugins are fully patched. A connected site treats commands signed with its UpdraftCentral key as authorized, so an attacker holding a valid key can act through the intended management channel rather than exploit a flaw in the site’s software. That can complicate detection: the command may pass normal signature checks.

The risk also extends beyond the plugin itself. Researchers say a backdoor may create an account that remains after the malicious plugin is removed, and some versions hide from the plugin list. A site owner who installs the update but does not inspect and clean a potentially compromised site may leave unauthorized access in place. The consequences can include persistent control of the site and further changes made under a privileged account.

Exposure may be hard for some owners to spot. The option to add a website to UpdraftCentral is enabled by default when connecting a TeamUpdraft account in UpdraftPlus settings, according to the source report; keys also do not expire. Nethemba said it found keys created in November 2025 being used after the breach. Users may therefore need to check whether a site was connected and when its key was created, rather than assume only recently configured sites are relevant.

How the Key Revocation Changed

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the incident to the UK Information Commissioner’s Office. The company’s initial UpdraftPlus release, version 1.26.12 on October 19, was intended to revoke all UpdraftCentral Cloud keys created before the incident.

Nethemba’s code review found that version 1.26.12 did not delete keys because of a bug. TeamUpdraft released version 1.26.13 later that day; its changelog said it “Properly apply[ies] the revocation in 1.26.12.” Nethemba reported that the corrected release deletes keys created before 12:07 UTC on October 18. The source report says keys created from 12:07 to 21:00 UTC that day are not deleted by the release and must be removed manually; TeamUpdraft’s stated cutoff was 22:00 BST, equivalent to 21:00 UTC.

Nethemba said it detected the attack on three of its own sites and attributed the activity to keys leaked from the UpdraftCentral Cloud environment. It said its investigation ruled out a modified plugin, weak cryptography and the older forgery issue CVE-2026-10795, fixed in June in version 1.26.5. Those are the firm’s findings, not a public forensic report from TeamUpdraft.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

How Many Sites Remain Exposed

TeamUpdraft has not said how many customers or WordPress sites were affected, how many keys were accessed, or whether every key in the database was usable by the attackers. The source report does not provide a full public incident timeline or independently verified account of how the attackers entered the website and reached the database.

The status of keys created during the October 18 cutoff window also needs careful checking. Nethemba’s review says version 1.26.13 does not revoke keys created from 12:07 to 21:00 UTC, while TeamUpdraft’s stated cutoff is 21:00 UTC. Owners may need to determine their key-creation times and remove keys outside the release’s coverage. The update alone cannot establish whether a site was compromised.

Backdoor variants and cleanup advice may change as researchers examine more samples. Nethemba and Patchstack warn that removing a suspicious plugin is not sufficient proof that the site is clean; a related account may remain, and some variants behave differently. The full scope of persistence and the number of affected installations remain undisclosed in the supplied reporting.

Update, Revoke, Then Inspect

TeamUpdraft customers should install the current corrected UpdraftPlus release and follow the latest company advisory. Site owners should check whether UpdraftCentral Cloud was connected, review the relevant key creation date, and manually revoke any key not covered by the automated cutoff. TeamUpdraft’s recommendation, as reported in the source material, is to re-authorize connected storage and rotate its access keys if UpdraftCentral was used to access the site.

Owners who find a suspicious plugin or account should treat the site as potentially compromised, not assume that updating or deleting one plugin is enough. Review administrator and other privileged accounts, investigate unexpected changes, and use current guidance from TeamUpdraft, Patchstack and Nethemba. The research firms’ analyses should be checked for updates as additional backdoor variants are identified.

Further clarity depends on TeamUpdraft publishing the affected-customer and site counts, details about the entry route, and any changes to its remediation guidance. Until then, the confirmed response is limited: the company says it closed the access route and rotated several credentials, while researchers report that a corrected plugin release revokes only keys within its stated cutoff and does not clean already infected sites.

Key Questions

What happened in the TeamUpdraft breach?

TeamUpdraft said attackers accessed teamupdraft.com over the weekend of October 17–18, 2026, and the company believes they reached a customer database containing connection keys for UpdraftCentral Cloud and other customer information. Researchers say stolen UpdraftCentral keys were used to send commands that installed backdoor plugins on WordPress sites.

Does updating UpdraftPlus remove a backdoor?

No. Version 1.26.13 is intended to revoke some exposed connection keys. It does not remove a malicious plugin or account already placed on a site, so updating is not a substitute for checking and cleaning a potentially affected installation.

Which UpdraftPlus versions should users install?

The source report identifies UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) as the releases intended to address key revocation. Users should check TeamUpdraft’s current advisory for the latest supported version and instructions, as remediation guidance may change.

Were payment details or stored backups exposed?

TeamUpdraft said it did not store payment-card data; payments are handled by Stripe and PayPal. It also said backups sent directly to third-party storage such as Google Drive, Dropbox or Amazon S3 were not affected. The company reported that customer details, password hashes, two-factor settings and service connection keys were in the database it believes attackers reached.

How many WordPress sites were affected?

The number has not been disclosed. TeamUpdraft has not provided a count of affected customers or sites. Patchstack reported observing 99 different plugin names in malicious installations during the stated period, but that figure is not a count of compromised sites.

Source: ThorstenMeyerAI.com