UpdraftCentral’s Key Problem: WordPress Sites Face Backdoors And A Fix Gap

🔍 Read the full analysis: UpdraftCentral's Key Problem: WordPress Sites Face Backdoors And A Fix Gap on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers accessed its teamupdraft.com website and likely reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers reported that attackers used stolen keys to install backdoor plugins on WordPress sites, including sites running current software, while TeamUpdraft’s new UpdraftPlus update revokes only some keys and does not remove backdoors already installed.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the website access took place over the October 17–18 weekend. Its incident post says the database may have included customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys associated with UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card data; payments are handled by Stripe and PayPal.

Researchers at Patchstack analysed the attack and said the stolen UpdraftCentral keys were used to send a command that uploads and activates a plugin. A connected WordPress site accepts commands signed with its key, so the command passed the plugin’s authentication checks. No software flaw was required, Patchstack said, and researchers reported affected sites running the latest version. TeamUpdraft says UpdraftPlus downloads and self-hosted UpdraftCentral were not affected.

TeamUpdraft released UpdraftPlus 1.26.13 and Premium 2.26.13 to revoke keys. Nethemba, a security firm that reported finding the attack on three of its sites, said an earlier release, version 1.26.12, failed to delete keys because of a bug. It said version 1.26.13 removes keys created before 12:07 UTC on October 18, but keys created between 12:07 and 21:00 UTC that day still require manual deletion. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, or 21:00 UTC.

Why a Dashboard Key Could Install Backdoors

The incident matters because UpdraftCentral keys authorize remote commands on connected sites. According to Patchstack, a valid signed command can tell WordPress to install and activate a plugin. In this case, the attackers did not need to exploit an unpatched WordPress vulnerability; access to the key was enough to make the command appear legitimate to the site.

Patchstack counted 99 plugin names used in installations between the afternoon of October 18 and 09:23 on October 19. Names included “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” Researchers identified the description “Small maintenance toolkit: keeps option storage tidy” as a useful indicator, but plugin names can vary, and some versions reportedly hide from the plugin list.

Researchers say some backdoors create an account with elevated capabilities and a persistent login cookie. That can let an attacker return without using the normal login form, which may bypass protections such as two-factor checks and login limits. Removing the plugin alone may not remove the account. For site owners, the incident therefore calls for checking both the key exposure and signs of activity that may have occurred before revocation.

How UpdraftCentral Keys Were Issued

UpdraftPlus includes an UpdraftCentral client that remains inactive until a site is connected with a key. TeamUpdraft’s service lets users manage multiple WordPress sites through a hosted dashboard. The company said the compromised database contained those connection keys, which researchers believe were used from an attacker-controlled server.

Nethemba said a key may have been created without a site owner noticing: the option to add a website to UpdraftCentral is selected by default when connecting a TeamUpdraft account in UpdraftPlus settings. The firm also reported that keys did not expire and found keys created in November 2025 used after the breach. It said its analysis did not point to a modified plugin, weak cryptography or the older forgery issue CVE-2026-10795, which was fixed in June in version 1.26.5.

TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company said backups stored directly with services such as Google Drive, Dropbox or Amazon S3 were not affected, though it recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access a site.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Accounts and Sites Remain Unknown

TeamUpdraft has not said how many customers or WordPress sites were affected, or how many stolen keys were used. It also has not established publicly whether every record in the database was accessed. The company’s statement says it believes attackers reached the customer database; that is not the same as a published account of precisely what was taken or viewed.

The number of compromised sites may also change as investigations continue. Researchers have described multiple backdoor variants, and TeamUpdraft’s key revocation does not identify or clean an infected site. A site owner who finds a suspicious plugin or account should not assume that updating UpdraftPlus resolves the compromise. Nethemba and Patchstack warn that one early variant can cause HTTP 500 errors; they advise removing the broken plugin rather than repairing it, because repairing it may allow the backdoor to run.

It is also unclear from the published material how many keys created during the October 18 cutoff gap remain active. Nethemba says those keys need manual deletion, while the precise steps for identifying and removing them depend on when a connection was created. Cleanup advice may change as researchers examine more variants.

Check Connections and Clean Infected Sites

TeamUpdraft users should consult the company’s current incident advisory and install the applicable UpdraftPlus 1.26.13 or Premium 2.26.13 update. Because the revocation window has limits, site owners should also check whether a connection key was created in the October 18 gap identified by Nethemba and follow the vendor’s instructions for deleting any affected key manually.

Owners should inspect connected sites for suspicious plugins and administrator-capable accounts, including accounts with unfamiliar names or “Site Tools” as a display name. If a backdoor is found, the researchers’ warning is to treat the site as compromised: removing the plugin may not remove a created account or persistent access. Site owners should follow current guidance from TeamUpdraft and the security researchers when restoring site integrity and rotating relevant credentials.

The incident response remains active. TeamUpdraft has not announced a final count of affected users or sites, and further details may follow as the company and researchers complete their investigations.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke certain UpdraftCentral keys. It does not remove a backdoor plugin or account already added to a site, according to the incident details and researcher guidance.

Which UpdraftPlus versions contain the key revocation?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. The source says version 1.26.12 did not revoke keys as intended.

Were backups stored in Google Drive or Amazon S3 exposed?

TeamUpdraft said backups sent to users’ own storage, including Google Drive, Dropbox and Amazon S3, were not affected. It recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access the site.

How can site owners check whether a site is affected?

Review connected sites for suspicious plugins and unfamiliar accounts, and follow the current TeamUpdraft, Patchstack and Nethemba advisories. Researchers named several plugin labels and a recurring description, but names vary, so those indicators alone may not identify every variant.

Did TeamUpdraft say how many customers were affected?

No. The company has not published a count of affected customers or sites in the supplied incident information.

Source: ThorstenMeyerAI.com