What To Check After UpdraftCentral Keys Are Stolen And WordPress Sites Are Backdoored

🔍 Read the full analysis: What To Check After UpdraftCentral Keys Are Stolen And WordPress Sites Are Backdoored on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft disclosed a security breach on October 19 after attackers accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say those keys were used to install backdoor plugins on WordPress sites, so installing the latest UpdraftPlus version revokes some exposed credentials but does not remove malware or unauthorized accounts already on a site.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed teamupdraft.com over the weekend of October 17–18 and that it believes they reached its customer database. The company said the database included customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said payment-card information was not stored, as Stripe and PayPal process payments, and backups held in customers’ own storage accounts were not affected.

Patchstack’s analysis found attackers used stolen keys to send a command to upload and activate a plugin. Because the commands were signed with valid dashboard keys, the UpdraftPlus client accepted them; researchers say no plugin vulnerability was needed. Sites with current software could be affected. Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 UTC on October 19. A recurring plugin description was “Small maintenance toolkit: keeps option storage tidy.”

TeamUpdraft released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) to address key revocation after an earlier release, version 1.26.12, failed to revoke keys, according to Nethemba’s code review. Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, but keys created from then until 21:00 UTC may need manual deletion. TeamUpdraft’s stated cutoff was 22:00 British Summer Time, or 21:00 UTC. Updating is not a cleanup operation: installed backdoors and accounts remain unless removed separately.

Why Key Revocation Is Not Enough

The incident shows how a legitimate remote-management credential can give an attacker a route into connected sites without exploiting a defect in the site’s installed plugin. A site owner may have enabled the UpdraftCentral connection without realizing it: the option to add a site to centralized control is ticked by default when connecting a TeamUpdraft account, according to the source material. Nethemba also reported finding keys created in November 2025 still usable, indicating that keys did not expire automatically.

That makes the response two separate tasks: invalidate credentials that may have been exposed, then inspect each connected site for changes made with those credentials. An infected site may contain a hidden plugin or a new account with elevated permissions. Researchers warn that removing the plugin alone may not remove the account, and that fixing a crashing backdoor variant could allow it to run. Site owners should treat a site where a backdoor is found as compromised and follow current vendor and researcher guidance rather than assuming a plugin update restored trust.

The affected systems are not limited to one WordPress installation. UpdraftCentral is designed to manage multiple sites from a dashboard, so exposed connection keys could have implications across a customer’s connected sites. The number of affected customers and sites has not been disclosed, leaving the scale of the incident uncertain.

How the Dashboard Keys Worked

UpdraftPlus includes an UpdraftCentral client that remains inactive until a site is connected with a key. After connection, the site accepts commands signed with that key, with permissions tied to the user who created it. Patchstack said the attackers’ plugin-upload command passed the client’s checks because it carried a genuine signature. The researchers’ account is that the keys, rather than a forged command or modified plugin, enabled the activity.

Nethemba said it found the attack on three of its own sites and traced the activity to keys used from the attacker’s server. It ruled out a modified plugin, weak cryptography and the older key-forgery issue CVE-2026-10795, which had been fixed in UpdraftPlus 1.26.5 in June, according to its analysis. The source material describes the breach as the second serious incident involving this channel in five months, though it does not provide further detail on the earlier incident.

TeamUpdraft said it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the incident to the UK Information Commissioner’s Office. Customers who used UpdraftCentral to access their sites are advised by the company to re-authorize external storage and rotate its access keys.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

The Unknown Scope of Infected Sites

TeamUpdraft has not said how many customers, connection keys or WordPress sites were affected. The company’s statement that it believes attackers accessed the customer database does not establish exactly which records were taken or how many keys were used. Researchers identified multiple plugin names and variants, so the available indicators may not cover every infected site.

The cutoff for automatic key revocation is another practical uncertainty for individual users. Nethemba says keys created between 12:07 and 21:00 UTC on October 18 are not deleted by version 1.26.13, despite the vendor’s stated cutoff of 21:00 UTC. Site owners may need to determine when their key was created and check the vendor’s current instructions. The source material does not establish whether all affected customers have been notified or provide a final accounting of the breach.

What Site Owners Should Check Now

Site owners should update UpdraftPlus to version 1.26.13 or the corresponding current release for their edition, then follow TeamUpdraft’s latest advisory on reviewing and deleting any keys outside the automatic revocation window. They should check connected sites for unfamiliar plugins, including names reported by Patchstack, and examine plugin descriptions, user accounts and permissions for unrecognized entries. A suspicious plugin’s removal may not remove a user account, so both need separate review.

For any site where a backdoor or unauthorized account is found, owners should treat it as compromised and use current guidance from TeamUpdraft, Patchstack and Nethemba to contain and restore it. They should also re-authorize connected storage and rotate relevant access keys if UpdraftCentral was used to reach the site. TeamUpdraft’s continuing advisory and further researcher analysis are the next sources to watch as investigators refine indicators and the company clarifies the number of affected accounts and sites.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke some exposed UpdraftCentral keys. It does not remove an already installed backdoor or an account that the backdoor created; those require separate investigation and cleanup.

Which UpdraftPlus versions did TeamUpdraft release?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. Site owners should check the company’s current advisory for the applicable release and any later updates.

What signs of a backdoor did researchers report?

Patchstack reported multiple unfamiliar plugin names, including “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” A recurring description was “Small maintenance toolkit: keeps option storage tidy.” Researchers also described unauthorized accounts with elevated permissions. These indicators may not identify every variant.

Were customer payment cards or personal backups exposed?

TeamUpdraft said it did not store card data because Stripe and PayPal handle payments, and said backups sent to customers’ own storage services were not affected. It advised users who accessed sites through UpdraftCentral to re-authorize storage and rotate access keys.

How many sites were affected?

The total has not been disclosed. TeamUpdraft has not provided a count of affected customers or sites, and the incident response and researcher analysis are ongoing.

Source: ThorstenMeyerAI.com