🔍 Read the full analysis: WordPress Security And UpdraftCentral: The Problem With Stolen Keys on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
TeamUpdraft said attackers accessed its website and likely its customer database, which contained keys used to control WordPress sites through UpdraftCentral Cloud. Researchers found those keys were used to install backdoor plugins, including on fully patched sites; an UpdraftPlus update revokes some keys but does not remove existing backdoors or accounts.
TeamUpdraft disclosed a security breach on October 19 after attackers accessed its teamupdraft.com website and, the company believes, reached a customer database containing UpdraftCentral Cloud connection keys. Security researchers say stolen keys were used to install backdoor plugins on WordPress sites, including sites running current software versions; updating UpdraftPlus revokes some keys but does not remove a backdoor already installed.
TeamUpdraft, the company behind the UpdraftPlus backup plugin, said attackers accessed its website over the weekend of October 17 and 18. Its incident notice said the affected database contained customer names, email and billing addresses, order histories, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card data, which is handled by Stripe and PayPal.
TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The company released UpdraftPlus 1.26.13 and Premium 2.26.13 to apply a key-revocation fix after an earlier release, 1.26.12, did not revoke keys as intended. According to security firm Nethemba, the newer version removes keys created before 12:07 UTC on October 18. Nethemba said keys created from 12:07 to 21:00 UTC that day were not removed by the update and require manual deletion.
Researchers at Patchstack analysed commands sent during the attack and found that the attacker used a command to upload and activate a plugin. Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. One recurring description was “Small maintenance toolkit: keeps option storage tidy.” Some backdoor variants create administrator-capable accounts and can hide from the plugin list, according to the researchers. Removing the vulnerable connection key does not remove the installed plugin or accounts.
Infographic 01 · UpdraftCentral key compromise
Stolen keys, signed commands, backdoored sites.
Keys leaked from TeamUpdraft's customer database let attackers send valid commands to connected WordPress sites. No plugin vulnerability was needed.
Timeline
Times as reported by the named source.
- 17 Oct, evening · Attacker has access to teamupdraft.com (Nethemba)
- 18 Oct, afternoon · First backdoor plugin installed via a signed UpdraftCentral command (Patchstack)
- 19 Oct, 09:23 · Latest backdoor install seen; 99 plugin names in total (Patchstack)
- 19 Oct, 13:00 UTC · TeamUpdraft publishes its incident advisory (Patchstack)
- 19 Oct · UpdraftPlus 1.26.12: key revocation ships, but a bug deletes no key (Nethemba)
- 19 Oct, evening · 1.26.13 fixes it; keys made 18 Oct 12:07–21:00 UTC still remain (Nethemba)
Patchstack and Nethemba analyses are being updated as new variants appear.
What the update does, and doesn’t
Based on Nethemba’s code review and TeamUpdraft’s advisory.
- 1
1.26.12 / 2.26.12
Meant to revoke the stolen keys. Because of a bug, it deleted none (Nethemba).
- 2
1.26.13 / 2.26.13
Revokes UpdraftCentral Cloud keys created before 12:07 UTC on 18 Oct.
- 3
Gap: 18 Oct, 12:07–21:00 UTC
Keys created in this window are not revoked, although the vendor's cutoff is 21:00 UTC.
- 4
Backdoors stay
Revoking a key does not remove an installed backdoor plugin or the account it created.
- 5
Guidance still changing
New backdoor variants keep turning up; vendor and researcher advisories are being updated.
Sources: TeamUpdraft (19 Oct 2026); Patchstack; Nethemba (updated 20 Oct 2026).
Powered by Thorsten Meyer AI
Why Stolen Keys Bypassed Site Defenses
The incident shows a risk that differs from a conventional software flaw. An UpdraftCentral key is intended to authorize remote management commands. Patchstack said the commands it examined were correctly signed with genuine dashboard private keys, so the plugin’s checks accepted them. That means attackers did not need to exploit a weakness in the WordPress site or its installed UpdraftPlus version to issue the commands.
The reach may be broader than site owners expect. UpdraftPlus includes a dormant UpdraftCentral client, and the option to add a site to remote management is checked by default when connecting a TeamUpdraft account, according to the source report. Nethemba also reported that keys did not expire and said it found keys created in November 2025 used after the breach. A site owner may therefore need to check for an old connection, not just a recently created one.
The cleanup has two separate parts: revoke exposed keys and inspect the site for persistence. A successful update can prevent use of keys covered by its revocation but does not undo an attacker’s changes. Researchers warn that backdoor-created accounts may remain even after the plugin is deleted, leaving compromised sites at risk unless administrators investigate and remove them.
Products Worth Considering
LG UltraGear 34G600A-B 34-Inch Curved WQHD Gaming Monitor, 160Hz
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1, DisplayPort 1.4, Black
As an affiliate, we earn on qualifying purchases.
How the Cloud Connection Works
UpdraftCentral Cloud is a hosted dashboard for managing multiple WordPress sites. The UpdraftPlus plugin on a connected site accepts commands authenticated with the site’s connection key. In this incident, the reported command was plugin.upload_plugin, which caused WordPress to install and activate an uploaded plugin.
Nethemba said it found the attack on three of its own sites and attributed it to keys leaked from the UpdraftCentral Cloud environment and used from an attacker-controlled server. The firm said its analysis ruled out a modified plugin, weak cryptography and the older forgery issue CVE-2026-10795, which had been fixed in June in UpdraftPlus 1.26.5. The incident report describes this as a second serious incident involving this channel within five months, but the supplied material does not give details of the earlier incident.
TeamUpdraft said it closed the access route, signed out all accounts, disconnected all UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the incident to the UK Information Commissioner’s Office. The company recommends reauthorizing external storage and rotating its access keys for users who used UpdraftCentral to access their sites.
““The commands are correctly encrypted and signed with genuine dashboard private keys.””
— Patchstack
How Many Sites Remain Exposed
TeamUpdraft has not said how many customers or WordPress sites were affected, or whether it can identify every key used by attackers. The full scope of the database access and the number of sites where backdoors were successfully installed remain unclear. The source material also does not establish whether all backdoor variants have been identified.
The key revocation has limits: according to Nethemba, keys created during part of October 18’s exposure window are not removed automatically, while keys created after the cutoff are left in place. Site owners may not know when a key was created. Researchers and the vendor have also said cleanup guidance is changing as new variants are found. No complete public list of affected sites or confirmed cleanup status is provided.
Actions for Site Administrators
Administrators should consult the latest TeamUpdraft advisory and the current Patchstack and Nethemba analyses, then update to the relevant UpdraftPlus release. They should check whether their site was connected to UpdraftCentral Cloud, review and remove any affected connection keys, and follow current guidance on reauthorizing external storage and rotating its access credentials.
Sites where a suspicious plugin or account is found should be treated as compromised, not repaired by the UpdraftPlus update alone. Administrators should remove identified backdoors and unauthorized accounts and review the site for other persistence, using incident-response guidance appropriate to their setup. TeamUpdraft’s investigation, the number of affected sites and the final cleanup recommendations remain developing.
Key Questions
What was exposed in the TeamUpdraft breach?
TeamUpdraft said the accessed customer database contained personal and account information, including UpdraftCentral connection keys, plus keys for UpdraftVault and UpdraftClone. The company said payment card data was not stored in that database.
Does updating UpdraftPlus remove a backdoor?
No. The update can revoke keys within its stated coverage, but it does not remove backdoor plugins or accounts that may already have been installed on a site.
Were fully patched WordPress sites affected?
Patchstack said attackers used valid, signed management commands, and that sites running the latest version were affected. The reported attack did not require a software vulnerability in the site plugin.
What should site owners check?
Check whether the site was connected to UpdraftCentral Cloud, follow TeamUpdraft’s current key-revocation guidance, and inspect for suspicious plugins and accounts. If UpdraftCentral was used to access external storage, TeamUpdraft recommends reauthorizing that storage and rotating its access keys.
Source: ThorstenMeyerAI.com
