WordPress Backdoor Concerns Grow Around Stolen UpdraftCentral Keys

🔍 Read the full analysis: WordPress Backdoor Concerns Grow Around Stolen UpdraftCentral Keys on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin, said on October 19, 2026, that attackers accessed its website and may have reached a customer database containing keys for its UpdraftCentral Cloud service. Security researchers report that the stolen keys were used to send commands that installed backdoor plugins on WordPress sites, including sites running up-to-date software; updating UpdraftPlus can revoke some keys, but it does not remove an installed backdoor.

In its incident notice, TeamUpdraft said the attackers accessed teamupdraft.com over the weekend of October 17 and 18, and that the company believes they reached its customer database. The information there included names, email and billing addresses, order history, password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said payment-card data was not stored in the database because Stripe and PayPal process payments.

TeamUpdraft said its UpdraftPlus plugin, plugin downloads and self-hosted UpdraftCentral were not affected. It released UpdraftPlus 1.26.13 and 2.26.13 Premium to revoke exposed UpdraftCentral keys. The vendor said it closed the access route, signed users out, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys used with payment providers. It also reported the breach to the UK Information Commissioner’s Office.

Researchers at Patchstack analyzed the attack and said commands signed with genuine UpdraftCentral keys instructed WordPress to upload and activate plugins. Patchstack counted 99 different plugin names installed between the afternoon of October 18 and 09:23 on October 19. Some examples were “Site Health Cache,” “Seo Helper,” “Wp Forge” and “Js Clean.” A recurring plugin description was “Small maintenance toolkit: keeps option storage tidy.”

Why Cloud Keys Could Install Backdoors

The incident shows how a legitimate remote-management connection can become an entry point when its credentials are exposed. UpdraftPlus includes an UpdraftCentral client that can remain dormant until a connection key is added. According to the researchers, a correctly signed command can then perform actions with the permissions associated with the user who created that key, including installing a plugin.

That means a conventional software update alone may not address the whole incident. Patchstack said the commands passed the plugin’s checks because they were signed with genuine dashboard keys; it found no need for an attacker to exploit a software vulnerability to send them. Sites running the latest UpdraftPlus release could still be affected if an exposed key had authorized a command before revocation.

Some reported backdoors create an unauthorized account and can grant it permissions that allow site administration and plugin installation. Researchers said certain variants can use a persistent login cookie, bypassing the normal login form. Removing a malicious plugin may not remove the account it created. Site owners therefore need to check both for suspicious plugins and for accounts or access changes that remain after the plugin is gone.

How UpdraftCentral Keys Became Exposed

UpdraftCentral Cloud is a hosted dashboard for managing multiple WordPress sites. A site connected to the service accepts commands authenticated with its connection key. According to TeamUpdraft, those keys were among the records in the customer database it believes attackers reached. The company said backups stored in customers’ own services, such as Google Drive, Dropbox or Amazon S3, were not affected. For sites managed through UpdraftCentral, however, TeamUpdraft recommends re-authorizing storage and rotating its access keys.

Security firm Nethemba said it found the attack on three of its own sites and concluded that keys leaked from the UpdraftCentral Cloud environment were used from an attacker-controlled server. Nethemba said it ruled out a modified plugin, weak cryptography and the older key-forgery flaw CVE-2026-10795, which was fixed in June in UpdraftPlus 1.26.5. Those findings are the firm’s analysis, not a final public account of the breach’s cause from TeamUpdraft.

Researchers also warned that a site owner may have enabled remote management without realizing it: the setting to add a site to UpdraftCentral is ticked by default when connecting a TeamUpdraft account in UpdraftPlus settings. Nethemba said connection keys do not expire and identified keys created in November 2025 that were used soon after the breach. That makes the age of a key an important part of determining whether it was covered by revocation.

“The company believes attackers reached its customer database.”

— TeamUpdraft, in its incident notice

Affected Sites and Keys Still Unclear

TeamUpdraft has not said how many customers or WordPress sites may be affected, or publicly described the full route attackers used to reach the database. The company says it believes the database was accessed, while researchers have described evidence of stolen keys being used against sites. The full scope of access and any exposure of individual customer records remain unclear.

The key revocation also has limits. Nethemba said version 1.26.13 deletes keys created before 12:07 UTC on October 18, but does not delete keys created from then until 21:00 UTC that day. TeamUpdraft’s stated cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC. According to Nethemba, keys in that interval require manual deletion. The vendor and researchers have not established how many such keys remain active.

Neither an UpdraftPlus update nor a successful key revocation confirms that a site is clean. Researchers have identified backdoor variants with different behavior, and some may hide from the plugin list. A variant reported by Nethemba and Patchstack can cause HTTP 500 errors before its token check; they warn against trying to repair that error because doing so could activate the backdoor. Cleanup guidance may change as further variants are investigated.

Site Owners Need Separate Cleanup

Site owners using UpdraftPlus should install the current vendor release and consult TeamUpdraft’s latest advisory alongside the Patchstack and Nethemba analyses. They should determine whether the site was connected to UpdraftCentral, whether its key falls within the revocation window, and whether a key in the uncovered interval needs to be deleted manually. Those steps address credentials, not evidence of prior compromise.

Where a suspicious plugin or unauthorized account is found, owners should treat the site as compromised and follow current incident-response guidance rather than relying on the plugin update alone. They should inspect for unfamiliar administrator-level access, review site activity and rotate credentials and connected storage keys as appropriate. TeamUpdraft’s recommendation to re-authorize storage applies to sites accessed through UpdraftCentral.

The next developments depend on TeamUpdraft’s continuing investigation and updates from security researchers. The company has not announced a final count of affected sites or customers. Until it provides more detail, the reach of the breach and the number of exposed keys that require action remain unresolved.

Key Questions

What did attackers obtain in the TeamUpdraft breach?

TeamUpdraft said attackers accessed its website and that it believes they reached a customer database containing personal and account information, password hashes, two-factor settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said payment-card details were not stored there.

Does updating UpdraftPlus remove an installed backdoor?

No. The update is intended to revoke some exposed UpdraftCentral keys. TeamUpdraft and security researchers warn that it does not remove a malicious plugin or an unauthorized account already created on a site.

Were fully patched WordPress sites affected?

Researchers reported that sites running current software were affected because commands signed with genuine stolen keys could pass the plugin’s checks. Their analysis describes use of exposed credentials rather than a requirement to exploit an unpatched software flaw.

Which UpdraftPlus version revokes the exposed keys?

TeamUpdraft released UpdraftPlus 1.26.13 and 2.26.13 Premium. Nethemba reported that the release deletes keys created before 12:07 UTC on October 18, 2026, while some keys created later that day may require manual deletion.

How many sites or customers were affected?

TeamUpdraft has not disclosed a total. Researchers reported findings on individual sites and identified many plugin names associated with the attack, but those figures do not establish the full number of affected customers or websites.

Source: ThorstenMeyerAI.com