Stolen UpdraftCentral Keys Are Backdooring WordPress Sites. The Fix Has A Gap.

🔍 Read the full analysis: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites. The Fix Has A Gap. on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft confirmed on October 19 that attackers accessed its teamupdraft.com website and may have reached a customer database containing UpdraftCentral connection keys, which were then used to install backdoor plugins on WordPress sites. The company has released UpdraftPlus updates to revoke some exposed keys, but the update does not remove backdoors already installed, and researchers report that a portion of keys may need manual revocation.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the website was accessed over the weekend of October 17 and 18. The company believes attackers reached its customer database, which held names, email and billing addresses, order history, hashed passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said payment card data was not stored in the database because payments are handled by Stripe and PayPal.

Security firm Patchstack analyzed the attack and reported that attackers used stolen keys to send a command to upload and activate a plugin. UpdraftPlus sites connected to UpdraftCentral accept commands signed with the relevant key, including commands to install plugins. Patchstack said the commands were signed with genuine dashboard keys, meaning the plugin’s checks passed; the attack did not require a software vulnerability, and sites running current software could be affected.

TeamUpdraft released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) after an earlier 1.26.12 release failed to revoke keys, according to Nethemba’s code review. Nethemba says version 1.26.13 removes keys created before 12:07 UTC on October 18, but does not remove keys created between 12:07 and 21:00 UTC that day. Those keys require manual deletion, the firm says. Separately, installing the update does not remove a malicious plugin or account already present on a site.

A Trusted Key Can Install Plugins

The incident shows how a legitimate remote-management feature can become an entry point when its credentials are exposed. A valid UpdraftCentral key authorizes commands on a connected site, so attackers could use the service’s normal capabilities to install code rather than exploit a flaw in the site’s current UpdraftPlus version. That makes updating alone an incomplete response.

For site owners, the risk extends beyond the plugin list. Researchers describe backdoors that can create privileged accounts and issue persistent login cookies, potentially bypassing ordinary login controls. Removing a suspicious plugin may not remove an account it created. A site where one of these backdoors is found should be treated as compromised and checked for remaining unauthorized access, based on current guidance from the vendor and security researchers.

The exposure may also be hard to spot in advance: TeamUpdraft’s customer-account connection option is enabled by default, according to the source report, and Nethemba says the keys it observed did not expire. The total number of affected customers and sites has not been disclosed.

How the Connection Became a Risk

UpdraftPlus includes an UpdraftCentral client that remains inactive until a site is connected with a key. Once connected, the site can execute properly signed commands with the permissions associated with the user who created that key. The customer database breach therefore exposed credentials capable of directing actions on linked WordPress installations.

Patchstack counted 99 different plugin names used in installations between the afternoon of October 18 and 09:23 on October 19, according to its analysis. One recurring plugin description was “Small maintenance toolkit: keeps option storage tidy.” Nethemba said it found the activity on three of its own sites and traced the keys to the UpdraftCentral Cloud environment. It said its analysis ruled out a modified plugin, weak cryptography and the older forgery bug CVE-2026-10795, which was fixed in UpdraftPlus 1.26.5 in June.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. It also said backups sent directly to services such as Google Drive, Dropbox or Amazon S3 were not affected. However, it recommends users who used UpdraftCentral to access a site re-authorize that storage and rotate its access keys.

““The commands are correctly encrypted and signed with genuine dashboard private keys.””

— Patchstack

Affected Sites and Keys Remain Uncounted

TeamUpdraft has not disclosed how many customers or WordPress sites were affected, or how many exposed keys were used. The company said it believes attackers reached the customer database; the full scope of data accessed has not been established in the supplied information. The gap identified by Nethemba concerns keys created during a specific October 18 window, while the vendor’s stated revocation cutoff differs from the cutoff Nethemba says the update applies.

Researchers have reported multiple backdoor variants, and cleanup advice may change as further variants are identified. The source material does not establish that every UpdraftCentral-connected site was targeted, nor does it provide a complete, final list of affected installations. Owners should not assume a site is clean solely because it has been updated or because no unfamiliar plugin is visible.

Revocation and Site Cleanup Continue

TeamUpdraft says it closed the access route, signed out all accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It has also reported the incident to the UK Information Commissioner’s Office. Site owners should check the company’s current advisory and the latest Patchstack and Nethemba guidance, update UpdraftPlus, and determine whether any connected keys need manual revocation.

Those who find a suspicious plugin or account will need to investigate and remove the backdoor and any access it created; the plugin update does not do that work. TeamUpdraft and researchers may publish revised cleanup instructions as more details emerge. The number of affected sites, the full key-revocation scope and the final incident findings remain outstanding.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The update is intended to revoke affected connection keys, but it does not remove a backdoor plugin or account that may already have been installed. Sites need separate inspection and cleanup.

Which UpdraftPlus versions did TeamUpdraft release?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. Nethemba reported that the preceding 1.26.12 release did not revoke keys as intended.

Do all exposed keys get revoked by the update?

Not according to Nethemba’s analysis. It says version 1.26.13 removes keys created before 12:07 UTC on October 18, while keys created from 12:07 to 21:00 UTC that day require manual deletion. Check the current vendor and researcher guidance for the applicable steps.

Were payment card details or stored backups exposed?

TeamUpdraft said it did not store card data; Stripe and PayPal handle payments. It also said backups sent directly to services such as Google Drive, Dropbox or Amazon S3 were not affected. The company recommends re-authorizing storage and rotating access keys if UpdraftCentral was used to access the site.

How many sites were affected?

The total has not been disclosed. TeamUpdraft has not said how many customers or sites were affected, and researchers’ reported observations do not establish the full scope.

Source: ThorstenMeyerAI.com