Stolen UpdraftCentral Keys Can Backdoor WordPress Sites; The Fix Has A Gap

🔍 Read the full analysis: Stolen UpdraftCentral Keys Can Backdoor WordPress Sites; The Fix Has A Gap on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers accessed its website and may have reached a customer database containing UpdraftCentral Cloud connection keys, which can authorize commands on linked WordPress sites. Security researchers report that attackers used stolen keys to install backdoor plugins, while the company’s latest UpdraftPlus update revokes only a portion of exposed keys and does not remove backdoors already installed.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed teamupdraft.com over the weekend of October 17–18 and that the customer database may have been exposed. The company said the database included customer names, email addresses, billing addresses, order histories, password hashes, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said it did not store payment-card data; Stripe and PayPal process payments.

UpdraftCentral Cloud lets users manage multiple WordPress sites from a hosted dashboard. According to Patchstack’s analysis, a connected site accepts commands signed with its valid connection key. Patchstack said attackers used the command plugin.upload_plugin to upload and activate malicious plugins. Because the commands were signed with genuine keys, the activity did not require exploiting a flaw in the site’s installed UpdraftPlus software. Researchers say fully patched sites could be affected.

TeamUpdraft released UpdraftPlus 1.26.13 for the free version and 2.26.13 for Premium after an earlier revocation attempt failed. Nethemba’s code review found that version 1.26.12, released October 19, did not delete the intended keys because of a bug. Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, but misses keys created between 12:07 and 21:00 UTC that day. Those keys require manual deletion, according to the researchers. Updating also does not remove an installed backdoor or any account it created.

Why Stolen Keys Bypass Site Defenses

The incident matters because the attackers reportedly used legitimate control credentials, rather than a software vulnerability, to issue commands to connected sites. That means a site can be running the latest plugin version and still be exposed if a stolen key remains valid. UpdraftPlus’s client is included in plugin installations and can be activated for remote management when a site is connected to a TeamUpdraft account.

Researchers say some keys may have been created without site owners noticing: the option to add a website to UpdraftCentral is selected by default when connecting a TeamUpdraft account. Nethemba also reported that keys do not expire automatically and found keys created in November 2025 being used after the breach. For site operators, updating the plugin is only one step; they also need to determine whether a key was exposed and check for unauthorized plugins and accounts.

The reported backdoor behavior can leave access behind even after its plugin is removed. Patchstack and Nethemba describe variants that create an account, grant it elevated capabilities and use a persistent login cookie. Some variants may hide from the plugin list. The persistence of the account means removing a suspicious plugin alone may not restore control of a site.

How UpdraftCentral Keys Work

UpdraftCentral Cloud is a hosted dashboard for managing WordPress sites remotely. The UpdraftPlus plugin contains a client that remains inactive until connected with a key. Once connected, the site accepts commands signed with that key and carries them out with the permissions associated with the user who created it. This design allows remote site management, but also makes an exposed key a route to issue administrative actions.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected by the breach. It also said backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected. However, for sites managed through UpdraftCentral, the company recommends re-authorizing storage connections and rotating access keys.

Nethemba said it found the attack on three of its own sites and attributed the activity to keys leaked from the UpdraftCentral Cloud environment. It said it ruled out a modified plugin, weak cryptography and the earlier key-forgery issue CVE-2026-10795, which was fixed in version 1.26.5 in June 2026. These are the firm’s findings; TeamUpdraft’s investigation and the full scope of the breach remain separate matters.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Breach Scope and Key Coverage

TeamUpdraft has not said how many customers or WordPress sites were affected, or confirmed the total number of exposed keys. The company said it believes attackers reached the customer database, while the researchers’ observations establish activity on specific sites but do not establish the full scale of compromise.

The key-revocation gap reported by Nethemba concerns keys created during a specific period on October 18. Site owners may not know when their keys were generated, and the supplied information does not establish that every key in that interval was used maliciously. The company and researchers have also warned that cleanup advice may change as additional backdoor variants are identified.

It is not clear from the available information whether every affected site can be identified through a central list or whether TeamUpdraft will provide individualized notices. The company said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It has reported the breach to the UK’s Information Commissioner’s Office.

Actions for Site Administrators

Administrators using UpdraftPlus should install the current version for their edition and consult TeamUpdraft’s latest advisory alongside the current Patchstack and Nethemba analyses. Because the update does not remove existing access, they should also check for unfamiliar plugins and administrator-level accounts, including accounts with unusual names or @example.org addresses. Researchers say some malicious plugins use descriptions such as “Small maintenance toolkit: keeps option storage tidy,” though names and behavior can vary.

If a suspicious plugin is found, Patchstack and Nethemba advise removing it rather than repairing an error caused by the plugin; they warn that fixing one early variant’s failure could allow its backdoor to run. Administrators should also investigate accounts and persistent sessions left behind, and treat a site with confirmed backdoor activity as compromised. For sites linked through UpdraftCentral, TeamUpdraft recommends re-authorizing backup-storage integrations and rotating their access credentials.

TeamUpdraft’s investigation, the number of affected sites and evolving cleanup guidance remain open issues. Site owners should follow updated vendor and researcher advisories rather than assume that installing version 1.26.13 alone closes every route to access.

Key Questions

What happened in the TeamUpdraft breach?

TeamUpdraft said attackers accessed teamupdraft.com over October 17–18 and may have reached a customer database containing UpdraftCentral Cloud keys. Researchers report that attackers used stolen keys to install backdoor plugins on WordPress sites.

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke certain exposed connection keys. It does not remove a backdoor plugin or accounts created by one, so affected sites need separate investigation and cleanup.

Which versions include the key-revocation fix?

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium). Nethemba says the fix deletes keys created before 12:07 UTC on October 18, but keys from 12:07 to 21:00 UTC that day are not removed automatically and must be deleted by hand.

Were payment details or stored backups exposed?

TeamUpdraft said it did not store payment-card data; Stripe and PayPal handle payments. The company said backups sent directly to a customer’s Google Drive, Dropbox or Amazon S3 storage were not affected, but recommends re-authorizing storage and rotating access keys for sites managed through UpdraftCentral.

How many sites were affected?

TeamUpdraft has not disclosed the number of affected customers or sites. Researchers reported finding backdoor activity on particular sites, but the overall scope remains unknown.

Source: ThorstenMeyerAI.com