A WordPress Security Alert: Stolen UpdraftCentral Keys And A Fix Gap

🔍 Read the full analysis: A WordPress Security Alert: Stolen UpdraftCentral Keys And A Fix Gap on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TeamUpdraft disclosed a security breach on October 19, saying attackers accessed its website over the October 17–18 weekend and may have reached a customer database containing keys for UpdraftCentral Cloud, its remote WordPress management service. Security firms Patchstack and Nethemba report that attackers used stolen keys to install backdoor plugins on connected sites, including sites running current software versions. TeamUpdraft has released UpdraftPlus 1.26.13 to revoke some exposed keys, but updating alone does not remove a backdoor already installed on a site.

TeamUpdraft, the company behind the UpdraftPlus backup plugin, said its customer database included names, email addresses, billing addresses, order histories, password hashes, two-factor authentication settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. The company said it did not store payment card details; Stripe and PayPal process payments. It also said backups stored by customers with services such as Google Drive, Dropbox or Amazon S3 were not affected.

The exposed UpdraftCentral keys can authorize commands on WordPress sites connected to the service. Patchstack said it observed the command plugin.upload_plugin being used to upload and activate plugins. Because the commands were signed with genuine dashboard keys, the plugin’s normal checks accepted them; according to the researchers, the attack did not require a software vulnerability. Patchstack counted 99 plugin names installed during the period from the afternoon of October 18 to 09:23 on October 19. That is a count of names observed, not a count of affected sites.

TeamUpdraft said it closed the access route, signed users out, disconnected UpdraftVault sites, replaced UpdraftClone keys and rotated keys with payment providers. It also reported the incident to the UK Information Commissioner’s Office. The company released UpdraftPlus versions 1.26.13 (free) and 2.26.13 (Premium) after an earlier revocation attempt in version 1.26.12 did not work as intended, according to Nethemba’s code review.

Why Stolen Keys Could Install Backdoors

The incident highlights the risk of credentials that grant trusted remote control. A connection key lets UpdraftCentral send commands to a site, and researchers say the attacker’s commands passed the plugin’s checks because they were properly signed. Keeping WordPress and UpdraftPlus patched did not block commands authorized by a stolen key, according to Patchstack’s analysis.

Researchers also warned that a connection may exist even if an administrator does not recall deliberately enabling centralized control. The UpdraftPlus settings option to add a site to UpdraftCentral is checked by default when connecting a TeamUpdraft account, and Nethemba reported similar default behavior in the Premium version. Nethemba also said it found keys created in November 2025 being used after the breach, indicating that old keys could remain usable.

For site owners, the practical distinction is between revoking access and cleaning an infection. Updating can remove certain old keys, but it does not remove an installed malicious plugin or the account that plugin may have created. A site where a backdoor is found should be treated as compromised while its contents and access are investigated.

How the Key Exposure Unfolded

UpdraftPlus is a WordPress backup plugin that includes a client for UpdraftCentral. The client remains dormant until a connection key is configured. Once connected, the site can execute correctly authorized commands with the permissions associated with the key. This is a management feature, but it also makes protection of the dashboard credentials central to site security.

TeamUpdraft’s October 19 disclosure said attackers accessed teamupdraft.com during the preceding weekend and that the company believed they had reached the customer database. Nethemba said it identified the activity on three of its own sites and attributed the commands to keys taken from the UpdraftCentral Cloud environment. It said its review did not point to a modified plugin, weak cryptography or the earlier vulnerability CVE-2026-10795, which had been fixed in UpdraftPlus 1.26.5 in June.

The first response, UpdraftPlus 1.26.12, was intended to revoke keys created before the incident. Nethemba reported that a bug meant it deleted no keys. TeamUpdraft then issued version 1.26.13. Nethemba’s analysis says that release removes keys created before 12:07 UTC on October 18, while keys created from 12:07 to 21:00 UTC that day are not removed by the update and require manual deletion. The vendor’s stated cutoff was 22:00 British Summer Time, equivalent to 21:00 UTC.

“The company said attackers accessed teamupdraft.com over the weekend of October 17 and 18 and that it believed they reached its customer database.”

— TeamUpdraft

How Many Sites Were Affected

TeamUpdraft has not disclosed how many customers or WordPress sites were affected. The 99 plugin names counted by Patchstack do not establish the number of installations or victims. The company’s statement says it believes the customer database was reached, but the full extent of data access and the number of exposed keys have not been reported in the supplied material.

Researchers have identified several indicators associated with the backdoors, including plugin descriptions and accounts created with elevated permissions, but they have also reported multiple variants. Some variants may hide from the plugin list; an early version reportedly caused HTTP 500 errors before checking for its activation token. Cleanup advice may change as further variants are examined. It is also not clear from the available information how many keys fall within the interval that version 1.26.13 does not revoke automatically.

Check Keys and Inspect Sites

Site owners using UpdraftPlus should consult the latest TeamUpdraft advisory and the current Patchstack and Nethemba analyses, then update to the applicable release: 1.26.13 for the free plugin or 2.26.13 for Premium. They should review UpdraftCentral connections and determine whether any keys require manual deletion, particularly keys created during the October 18 interval identified by Nethemba. TeamUpdraft recommends re-authorizing storage connections and rotating their access keys when UpdraftCentral was used to access the site.

Administrators should also inspect sites for suspicious plugins and accounts rather than treating the software update as a complete cleanup. Researchers warn that removing a backdoor plugin may not remove an account it created, and some variants may be concealed. If a suspect plugin is producing errors, Nethemba and Patchstack advise removing it rather than repairing it, because repairing certain variants may allow their backdoor behavior to run. Further vendor and researcher guidance is expected as the investigation and variant analysis continue.

Key Questions

Does updating UpdraftPlus remove a backdoor?

No. The update is intended to revoke certain UpdraftCentral keys, but it does not remove malicious plugins or accounts already installed. Site owners need to inspect and clean affected sites separately.

Which UpdraftPlus versions did TeamUpdraft release?

TeamUpdraft released version 1.26.13 for the free plugin and 2.26.13 for Premium. The earlier 1.26.12 revocation attempt reportedly failed to delete keys, according to Nethemba’s review.

Were customer payment card details exposed?

TeamUpdraft said it did not store card data and that Stripe and PayPal handle payments. The database did contain personal and account information, including names, email addresses, billing addresses, order history and password hashes.

How many WordPress sites were affected?

The number has not been disclosed. Patchstack counted 99 different plugin names in observed installations over a stated period; that figure is not a count of affected sites.

What should administrators do if they find a suspicious plugin?

Follow current guidance from TeamUpdraft and the security researchers. Their warning is to remove certain backdoor plugins rather than repair a broken one, and to check for accounts the plugin may have created. A site with a detected backdoor should be treated as compromised while its access and integrity are reviewed.

Source: ThorstenMeyerAI.com