Stolen UpdraftCentral Keys: A WordPress Backdoor Threat And A Fix With A Gap

🔍 Read the full analysis: Stolen UpdraftCentral Keys: A WordPress Backdoor Threat And A Fix With A Gap on ThorstenMeyerAI.com

TeamUpdraft said on October 19, 2026, that attackers had accessed its website and likely reached a customer database containing UpdraftCentral Cloud connection keys; security researchers report that stolen keys were used to install backdoor plugins on WordPress sites. The company released updated UpdraftPlus versions to revoke affected keys, but the update does not remove an installed backdoor, and some keys may require manual revocation.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said the access occurred over the weekend of October 17 and 18. Its incident notice says the database may have included customer names, email and billing addresses, order history, hashed account passwords, two-factor authentication settings, and keys for UpdraftCentral, UpdraftVault and UpdraftClone. TeamUpdraft said payment card details were not stored in the database; Stripe and PayPal process payments.

TeamUpdraft said the UpdraftPlus plugin itself, its downloads and self-hosted UpdraftCentral were not affected. The company released UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) to revoke certain UpdraftCentral Cloud keys. The first release, version 1.26.12, was intended to revoke keys but did not do so, according to security firm Nethemba’s review of the code. Nethemba said version 1.26.13 removes keys created before 12:07 UTC on October 18. Keys created from 12:07 to 21:00 UTC that day are not removed by the update and must be deleted manually, the firm reported.

Patchstack’s analysis found attackers sending a command to upload and activate a plugin. Because those commands were signed with genuine dashboard keys, the action could pass the plugin’s authorization checks without exploiting a software vulnerability. Patchstack counted 99 different plugin names used in installations between the afternoon of October 18 and 09:23 on October 19; this is a count of names, not a confirmed count of affected sites.

Why Stolen Keys Bypass Patching

The incident shows why updating WordPress software alone may not protect a site when an attacker has obtained a valid management credential. UpdraftPlus includes a client that can receive commands from UpdraftCentral. Once connected with a key, a site can act on correctly signed commands with the permissions associated with that connection. Researchers say this allowed attackers to install plugins even on sites running current software.

The reported backdoor behavior creates a separate cleanup problem. According to Patchstack and Nethemba, some malicious plugins can create an account with elevated capabilities and provide a persistent login cookie. Removing the plugin may not remove that account, and updating UpdraftPlus only addresses key revocation. Site owners who find evidence of the backdoor need to treat the site as compromised and check for remaining unauthorized accounts and access, following current incident guidance.

The exposure may also affect owners who do not recall enabling remote management. The option to add a site to UpdraftCentral when connecting a TeamUpdraft account is selected by default, according to the supplied analyses. TeamUpdraft has not published an affected-customer or affected-site count, so the scale of the incident remains unknown.

How UpdraftCentral Keys Work

UpdraftCentral Cloud is a hosted dashboard for managing multiple WordPress sites. UpdraftPlus installations include a client component that remains inactive until connected. A connection key authorizes the dashboard to send commands to that site; according to the researchers, a valid signed command can include installing a plugin.

Nethemba said it found the attack on three of its own sites and concluded the keys came from the UpdraftCentral Cloud environment and were used from an attacker-controlled server. The firm said it found no evidence that a modified plugin, weak cryptography or the earlier key-forgery flaw CVE-2026-10795 explained this attack. That earlier vulnerability was fixed in June in UpdraftPlus 1.26.5, according to the source material. Researchers describe the stolen-key incident as a separate issue.

TeamUpdraft said it closed the access route, signed out accounts, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also said it reported the incident to the UK’s Information Commissioner’s Office. TeamUpdraft recommends reauthorizing external storage and rotating its access credentials for sites managed through UpdraftCentral, even though backups stored in services such as Google Drive, Dropbox or Amazon S3 were not affected by the database breach.

“The commands are correctly encrypted and signed with genuine dashboard private keys.”

— Patchstack

Affected Sites and Keys Remain Unknown

TeamUpdraft has not said how many customers or WordPress sites were affected, or published a complete account of what attackers accessed. It is also not clear how many stolen keys were used successfully or how many sites still contain a backdoor. The researchers’ count of 99 plugin names does not establish the number of infected sites.

Key timing adds another complication. Nethemba said the update revokes keys created before 12:07 UTC on October 18, while keys created through 21:00 UTC that day require manual deletion. The source material says TeamUpdraft’s cutoff is 22:00 British Summer Time, equivalent to 21:00 UTC. Site owners may not know when a connection key was created, and connections made after the cutoff are not revoked by design.

Researchers have also identified different backdoor variants, including one that can cause HTTP 500 errors before its token check runs and others that hide from the plugin list. Nethemba and Patchstack warn against trying to repair a malfunctioning suspicious plugin: changing it could allow its backdoor code to run. Cleanup advice may change as additional variants are investigated.

Update, Revoke, Then Inspect

Site owners should install the applicable UpdraftPlus release and consult the latest TeamUpdraft advisory for instructions on identifying and manually deleting any keys that fall outside the automated cutoff. Those who use UpdraftCentral should also reauthorize connected external storage and rotate its credentials, as TeamUpdraft recommends.

Updating is not a substitute for checking the site. Owners should review for suspicious plugins and unauthorized accounts, including accounts that may remain after a plugin is removed. If a suspicious plugin is present, the researchers’ warning is to remove it rather than attempt to repair it; owners should use current guidance from TeamUpdraft, Patchstack and Nethemba or seek incident-response help.

TeamUpdraft’s investigation and researchers’ analysis are continuing. Further clarity depends on the company publishing the number of affected accounts or sites, explaining the full scope of data access, and issuing any revised cleanup steps as new variants are found.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The update is intended to revoke certain connection keys. It does not remove a malicious plugin or an account that the plugin may already have created.

Which UpdraftPlus versions address the stolen keys?

TeamUpdraft released version 1.26.13 for the free plugin and version 2.26.13 for Premium. Check TeamUpdraft’s current advisory for instructions on manual key revocation and any later updates.

Were stored backups or payment card details exposed?

TeamUpdraft said payment card details were not stored in the affected database and that backups sent to customers’ own storage, including Google Drive, Dropbox and Amazon S3, were not affected. It recommends reauthorizing that storage and rotating access keys if UpdraftCentral was used to manage the site.

How can a site owner tell whether a site was affected?

TeamUpdraft has not published a complete list of affected sites or a customer count. Owners should follow the company’s latest advisory and the Patchstack and Nethemba analyses, and inspect for suspicious plugins and unauthorized accounts. The researchers say some backdoor variants may hide from the plugin list.

Source: ThorstenMeyerAI.com