A Look At Stolen UpdraftCentral Keys And WordPress Site Backdoors

🔍 Read the full analysis: A Look At Stolen UpdraftCentral Keys And WordPress Site Backdoors on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft disclosed a security breach on October 19, 2026, saying attackers accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers report those keys were used to send commands that installed backdoor plugins on WordPress sites, including sites running current software versions.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the access occurred over the weekend of October 17–18. The company believes attackers reached a database containing customer names, email addresses, billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said it did not store payment-card data; Stripe and PayPal process payments.

TeamUpdraft released UpdraftPlus 1.26.13 and Premium 2.26.13 to revoke exposed keys after an earlier release, version 1.26.12, did not apply the intended revocation, according to security firm Nethemba. Nethemba’s code review found that version 1.26.13 removes keys created before 12:07 UTC on October 18. It said keys created between 12:07 and 21:00 UTC that day are not covered and must be deleted manually. Updating does not remove a malicious plugin or account already placed on a site.

Patchstack’s analysis found attackers used valid, signed UpdraftCentral commands to upload and activate plugins. It counted 99 plugin names installed between the afternoon of October 18 and 09:23 on October 19. One recurring description was “Small maintenance toolkit: keeps option storage tidy.” Some variants create accounts with elevated permissions and can hide from the WordPress plugin list, researchers said.

Why Valid Dashboard Keys Matter

The reported attack did not depend on exploiting a flaw in the WordPress core software or bypassing UpdraftCentral’s command-signing checks. According to Patchstack, the commands were correctly signed with genuine dashboard keys. That meant a site configured to accept a stolen key could treat the attacker’s command as authorized, even if the site’s plugins were up to date.

The incident also shows why a plugin update is only one part of response. Key revocation blocks some future commands, but it cannot undo changes already made on a site. A backdoor may leave behind a user account with capabilities to manage settings or install plugins, and removing the plugin may not remove that account. Site owners who used UpdraftCentral therefore need to check for both the malicious plugin and any accounts or access methods it created.

The exposure may reach users who do not recall enabling remote management. TeamUpdraft’s connection option is enabled by default when linking an account in UpdraftPlus settings, according to the source report; Nethemba said the Premium version behaves similarly. Researchers also reported that keys do not expire, making older credentials relevant to the breach.

How the UpdraftCentral Connection Works

UpdraftPlus includes a client component for UpdraftCentral. When a site is connected to the hosted dashboard, a connection key allows the dashboard to issue management commands to that WordPress installation. The report says commands run with the permissions of the user who created the key. A command to upload a plugin can therefore have direct effects on the site.

Nethemba said it found the attack on three of its own sites and attributed the activity to keys exposed from the UpdraftCentral Cloud environment. It said its investigation ruled out a modified plugin, weak cryptography and the older vulnerability CVE-2026-10795, which was fixed in UpdraftPlus 1.26.5 in June. TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. Those statements distinguish the reported breach of the hosted service and keys from a compromise of the plugin distribution process.

TeamUpdraft said it closed the access route, signed users out, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. Backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not reported affected, though TeamUpdraft recommends reauthorizing storage and rotating access keys if UpdraftCentral was used to access a site.

““Properly apply the revocation in 1.26.12.””

— TeamUpdraft

Exposure Scope and Cleanup Remain Open

The number of affected customers and WordPress sites has not been disclosed. TeamUpdraft said it believes attackers reached the customer database, but the published account does not establish how many records or keys were accessed or used. The exact number of sites with a backdoor is also unknown; Patchstack’s count refers to 99 plugin names observed, not 99 confirmed compromised sites.

It is also not yet clear whether every exposed key was used or how many sites contain backdoor accounts that remain after plugin removal. Researchers have described multiple variants, including versions that hide themselves and one early variant that can cause HTTP 500 errors before its token check runs. Nethemba and Patchstack warn against attempting to repair that error, saying doing so may activate the backdoor. Cleanup advice may change as further variants are identified.

The company’s key-revocation cutoff and the window identified by Nethemba do not fully align: TeamUpdraft’s stated cutoff was 22:00 BST on October 18, or 21:00 UTC, while Nethemba said the update did not delete keys created after 12:07 UTC. Site owners may need to verify key creation times and follow the latest vendor and researcher guidance rather than assume the update removed every exposed credential.

Next Steps for Site Administrators

Administrators using UpdraftPlus should install the current release and consult TeamUpdraft’s latest incident advisory for instructions on revoking keys, including any manual removal needed for keys outside the update’s cutoff. If UpdraftCentral was connected, they should reauthorize external storage connections and rotate related access keys as the vendor recommends.

Sites should also be checked for suspicious plugins and administrator or editor accounts, including accounts with unexpected names, addresses or elevated capabilities. A site where a backdoor is found should be treated as compromised; updating UpdraftPlus or deleting a visible plugin alone may not remove all persistence. Administrators should use current instructions from TeamUpdraft, Patchstack and Nethemba, and seek incident-response assistance if they cannot establish that the site is clean.

TeamUpdraft’s investigation and the researchers’ analysis are continuing. Further updates on affected records, sites, key-revocation coverage and cleanup steps would help clarify the breach’s full reach. Until then, site owners should not assume that a patched plugin or successful key revocation confirms that a previously connected site is free of attacker access.

Key Questions

What was exposed in the TeamUpdraft breach?

TeamUpdraft said the customer database may have included names, email addresses, billing addresses, order history, hashed passwords, two-factor settings and keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment-card data.

Does updating UpdraftPlus remove a backdoor?

No. The update is intended to revoke some exposed connection keys, but it does not remove a malicious plugin or account already installed on a WordPress site. Affected sites need separate inspection and cleanup.

Which UpdraftPlus versions contain the key-revocation fix?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba said the fix covers keys created before 12:07 UTC on October 18, 2026, while some keys created later in the reported window require manual deletion.

Were backups stored in Google Drive or Dropbox affected?

TeamUpdraft said backups sent directly to users’ own storage, including Google Drive, Dropbox or Amazon S3, were not affected. It recommends reauthorizing storage and rotating access keys if UpdraftCentral was used to access the site.

How many WordPress sites were compromised?

The number has not been disclosed. Patchstack counted 99 different plugin names in observed installations, but that figure is not a count of confirmed affected sites.

Source: ThorstenMeyerAI.com