What The Stolen UpdraftCentral Key Issue Means For WordPress Defenses

🔍 Read the full analysis: What The Stolen UpdraftCentral Key Issue Means For WordPress Defenses on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft said on October 19, 2026, that attackers accessed its teamupdraft.com website over the weekend and likely reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers report those keys were used to install backdoor plugins on WordPress sites, including sites running current software, making this an incident that a routine plugin update alone cannot resolve.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the affected database contained customer names, email and billing addresses, order histories, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. It said payment-card information was not stored in the database because Stripe and PayPal handle payments. The company also said backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected.

TeamUpdraft released UpdraftPlus 1.26.13 and Premium 2.26.13 to revoke exposed keys after an earlier release, 1.26.12, failed to do so because of a bug, according to security firm Nethemba’s code review. Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, but does not remove keys created between 12:07 and 21:00 UTC that day. Those keys require manual deletion. The vendor’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC.

Patchstack’s analysis found 99 plugin names used in installations recorded from the afternoon of October 18 to 09:23 on October 19. One recurring name was “Site Health Cache.” Researchers say a description reading “Small maintenance toolkit: keeps option storage tidy” is a more reliable indicator than the plugin name. The backdoor can create an account with elevated capabilities and establish a persistent login cookie; removing the plugin alone may not remove that account.

Why Key Revocation Is Not Cleanup

The incident shows how a legitimate remote-management feature can become a route into customer sites when its authorization keys are exposed. UpdraftCentral commands signed with a site’s key are accepted as valid. Patchstack says attackers used a command to upload and activate a plugin, so the affected sites did not need to be running an outdated UpdraftPlus version for the command to work.

That distinction matters for site owners and administrators: patching the plugin addresses exposed credentials, not an existing compromise. A backdoor may have created an account that persists after the plugin is deleted, and some variants can hide from the normal plugin list. Researchers warn that an early variant may cause HTTP 500 errors; attempting to repair the plugin could activate its backdoor behavior. Sites with signs of infection should be handled as compromised, with investigation and cleanup beyond an ordinary update.

The reported scale is not yet known. TeamUpdraft has not disclosed how many customers or WordPress sites were affected. Even without that number, the incident is relevant to any organization using centralized tools to manage multiple websites: a single stolen management credential can carry authority across connected installations.

How UpdraftCentral Keys Work

UpdraftPlus includes a client for UpdraftCentral, a dashboard used to manage multiple WordPress sites. The client remains inactive until a site is connected with a key; after connection, it accepts commands signed with that key. According to Patchstack, the attacker’s commands were correctly signed with genuine dashboard private keys, which meant normal signature checks passed. Researchers say no software vulnerability was needed for this particular attack.

Nethemba reported finding the attack on three of its own sites and concluded that the keys came from the UpdraftCentral Cloud environment and were used from an attacker-controlled server. It said its analysis ruled out a modified plugin, weak cryptography and the earlier vulnerability CVE-2026-10795, which had been fixed in June in version 1.26.5. Nethemba also found that keys created as far back as November 2025 were used after the breach. The source account describes this as a second serious incident involving this channel within five months.

One setting may have connected sites without users noticing: the option to add a website to UpdraftCentral is ticked by default when a TeamUpdraft account is connected in UpdraftPlus settings, according to the source material. Nethemba says keys do not expire. Those details help explain why administrators may need to inspect existing connections rather than assume that only recently created keys are relevant.

“The company said attackers accessed teamupdraft.com over the weekend of October 17 and 18 and that it believes they reached its customer database.”

— TeamUpdraft

Affected Sites and Cleanup Scope

The total number of affected customers and sites remains unknown. TeamUpdraft has not published a count, and the available account does not establish how many installations received malicious plugins. It is also not clear from the source material whether the company has completed its investigation into how attackers accessed the website or database.

The precise set of exposed keys may require case-by-case checks. Nethemba’s review describes a period on October 18 when keys are not removed by version 1.26.13, while the vendor’s cutoff and the researchers’ findings differ in how they describe the relevant time window. Site owners should check the current vendor advisory and researchers’ updates for the latest instructions. Cleanup advice may change as additional backdoor variants are identified.

TeamUpdraft says it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys, rotated keys with payment providers and reported the incident to the UK Information Commissioner’s Office. Those steps do not establish whether every affected WordPress site has been identified or cleaned.

Steps for Site Administrators

Administrators should install the current UpdraftPlus release and review the latest TeamUpdraft advisory, alongside the Patchstack and Nethemba analyses. Updating is necessary to apply the available revocation, but it does not remove a backdoor or account already installed. Administrators should inspect connected UpdraftCentral keys, paying particular attention to keys created during the October 18 interval Nethemba identified, and manually remove keys the update does not revoke.

Site owners should check for suspicious plugins and accounts, including plugins with the recurring maintenance-tool description and accounts using the “Site Tools” display name or unusual addresses. These are indicators reported by researchers, not proof on their own that every similarly named item is malicious. If a backdoor is found, researchers’ warning is not to repair a crashing plugin in place: remove it and investigate the site as compromised, including accounts that may remain after plugin removal. Where UpdraftCentral was used to access a site, TeamUpdraft recommends re-authorizing backup storage and rotating its access keys.

The next milestones are further updates from TeamUpdraft and researchers as the investigation and cleanup guidance develop. The company has reported the incident to the UK Information Commissioner’s Office, but has not announced a final impact count. Until that information is available, affected site owners should treat key revocation and site-level compromise checks as separate tasks.

Key Questions

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke certain exposed keys. It does not remove a backdoor plugin or an account that the plugin created.

Which UpdraftPlus versions include the key-revocation fix?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba says some keys created on October 18 still require manual deletion.

Were customer backups or payment-card details exposed?

TeamUpdraft said payment-card data was not stored in the affected database, because Stripe and PayPal handle payments. It also said backups stored in customers’ own storage services were not affected. Customers who used UpdraftCentral should follow the vendor’s advice to re-authorize storage and rotate access keys.

How can a site owner check for a backdoor?

Researchers identified suspicious plugin names and a recurring description, along with accounts that may display as “Site Tools.” These are investigation leads, not a complete test. Some variants may hide from the plugin list, so follow current guidance from TeamUpdraft and security researchers and treat confirmed findings as a site compromise.

How many WordPress sites were affected?

The number has not been disclosed. TeamUpdraft has not stated how many customers or sites were affected, and the investigation is ongoing.

Source: ThorstenMeyerAI.com